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0 Electronic monetary system. 



0 An improved monetary system using electronic 
media to exchange economic value securely and 
reliably. The invention provides a complete monetary 
system having electronic money that is interchange- 
able with conventional paper money comprising (1) 
issuing banks or financial institutions that are coup- 
led to a money generator device for generating and 
issuing to subscribing customers electronic currency 
backed by demand deposits electronic credit au- 
thorizations; (2) correspondent banks that accept and 
distribute the electronic money: (3) a plurality of 
transaction devices that are used by subscribers for 



storing electronic money, for performing money 
transactions with the on-line systems of the partici- 
pating banks or for exchanging electronic money 
with other like transaction devices; (4) automated 
teller devices, associated with the issuing and cor- 
respondent banks, for process handling and interfac- 
ing the transaction devices to the issuing and cor- 
respondent banks, and for interfacing between the 
issuing and correspondent banks themselves; and 
(5) a clearing bank for balancing the electronic mon- 
ey accounts of the different issuing banks (6). 
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0 Electronic monetary system. 



0 An improved monetary system using electronic media to exchange economic value securely and r-eliably. 
The invention provides a complete monetary system having electronic money that is interchangeable with 
conventional paper money comprising (1) issuing banks or financial institutions that are coupled to a money 
generator device for generating and issuing to subscribing customers electronic currency backed by demand 
deposits electronic credit authorizations; (2) correspondent banks that accept and distribute the electronic 
money; (3) a plurality of transaction devices that are used by subscribers for storing electronic money, for 
performing money transactions with the on - line systems of the participating banks or for exchanging electronic 
money with other like transaction devices; (4) automated teller devices, associated with the issuing and 
correspondent banks, for process handling and interfacing the transaction devices to the issuing and cor- 
respondent banks, and for interfacing between the issuing and correspondent banks themselves; and (5) a 
clearing bank for balancing the electronic money accounts of the different issuing banks (6). 
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Background of the Invention " . . . , . ^ . . 

The present invention relates to an electronic monetary sysferri for implemehting felectf^dnlc money 
payments as an alternative medium of economic exchange to cash, checks, credit and debit cards, and 

5 electronics fund transfer. The Electronic - Monetary Syst^^ of currency, check, card payment 

systems and electronic funds trarisfei' systems', pdsi^essih^ niariy ''of the benefits of -these systems with few 
of their limitations. The system utilizes electronic representations of money which are designed to be 
universally accepted and exchanged- as economic value by subscribers of the monetary system. 

Today, approximately 350 billion' coin and currency transactions occur between individuals and 

10 institutions every year. The extensive use of coin and currency transactions has limited the automation of 
individual transactions such as purchases, fares, and bank account deposits and withdrawads. Individual 
cash transactions are burdened by the need of having the correct amount or providing change therefor. 
Furthermore, the handling and managing of paper cash and coins is inconvenient, costly and time 
consuming for both individual's' and' financial institutions alike. ■ * 

;5 Although checks may .be written for ^ahy^ amount up to the amount available in the account, 

checks have very linrii'teS transferability arid rhust be supplied from a physical ihvehfbry. Psipei' -based 
checking systems do not pffer sufficient relief from the limitations of cash transactions, shah ng 'many of th&'" 
inconveniences of handling currency while adding the inherent delays associated with processing checks. 
To this end. economic exchange has striven fofgrjeater convenience at a lower cost, while aiso seeking 

20 improved security. . . i- i . = . . . = , . 

Automation has achieved some of these qualities for large transactions through computerized electranici 
funds transfer ("EFT") systems. Electronic funds transfer is essentially a process of value exchange 
achieved through the iDankihg system *$. centralized computer transactions. EFT services are a transfer of 
payments utilizing electronic "checks," which ar'e used prirharily by large comnnerclal organizations. 

25 The Automated Clearing House (ACH) and point of sale (POS) systems are examples of electronic 
funds transfer systems r that have- become- used by retail and commercial organizations, on a substantial- 
basis in recent years; However; the payments made through these types of EFT systems are limited in that 
they cannot be performed outside of the banking system. Moreover, ACH transactions 'iJsi^ ail ly'^canh^^ 
performed during off business hours. 

30 Home banking bill payment services ^re examples, of. an electronic funds transfer system used by 
individuals: to make payments. Currently, hortie banking, initiatives have, found few ciistonners. Of the' banks 
that, have offered services for payments, account ti'ansifers and information over the telephone lin^s using, 
personal computers, less than one percent of the bank's customers are using the service. One reason that 
home banking has not been a successful . product because the customer cannbt deposit and withdraw, 

35 money as needed in this type of system.. . 

Current EFT systems, credit cards, or debit cards, which are used with an on-line system to transfer 
money between accounts, such as between the account of a merchant and that of a customer," cannot 
satisfy the need for an .automated transaction system that provides for thejransfer of universally accepted 
economic value outside of the banking system. . ' / ' 

40 To implement an automated, yet more convenient transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense some form of economic value, there has been a 
trend towards off-line electronic funds transfer. For example, numerous ideas have been proposed for 
some form of "electronic money" that can be used in cashless payment transactions as alternatives to the 
traditional cun-ency and check types of payment systems. See U.S. Patent No, 4,977,595, entitled 

45 "METHOD AND APPARATUS FOR IMPLEMENTING ELECTRONIC CASH, and U.S. Patent No. 4.305.059, 
entitled "MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic stripe cards purchased for a given amount and from 
which a prepaid valve can be deducted for specific purposes. Upon exhaustion of the economic valve, the 
cards are thrown away. Other examples include memory cards or so called smart cards which are capable 

50 of repetitively storing information representing value that is likewise deducted for specific purposes. 

However, these proposed systems suffer from a failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of universally accepted monetary representations 
that may be issued. In the systems disclosed thus far, representations of economic value, whether 
electronic or paper, are issued without the backing of equal valued liabilities as the counterpart to their 

55 assets. 

None of the paperless payment systems that have been proposed so far are comprehensive enough so 
as to implement a multipurpose electronic monetary system that includes not only the automated devices 
that allow subscribers to transfer electronic funds or money between them without any intermediating 
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system, but that also encompasses and includes an entire banking system for generating the value 
represented by the electronic money and for clearing and settling the electronic money accounts of the 
banks and financial institutions involved to maintain a monetary balance within the system. 

Thus, specifically, there is a need for a system that allows common payor to payee transactions without 
5 the intermediation of the banking system, and that gives control of the payment process to the individual. 
Furthermore, a need exists for providing a system of economic exchange that can be used by large 
organizations for commercial payments of any size, that does not have the limitations of the current EFT 
systems. 

Accordingly, it is an object of the present invention to overcome the aforesaid shortfalls by providing a 

10 complete electronic monetary system which utilizes electronic money that is interchangeable with traditional 
cash and is universally accepted. 

The present invention provides an electronic monetary system for providing transactions utiliziiig 
electronic representations of currency backed by demand deposits in a bank comprising: 
means for generating said electronic representations of currency; teller means for issuing and distributing 

15 said electronic representations of currency; transacting means for storing, and for transferring said 
electronic representations of currency between other transacting means and between said transacting 
means and said teller means. 

The present invention also provides an electronic monetary system for providing transactions utilizing 
electronic representations of credit authorizations comprising: x*-:-^' 
) 20 means for generating said electronic representations of credit: teller means for issuing and distributing said 
electronic representations of credit: transaction means for storing, and for transferring saidr^lectronic. 
representations of credit between other transacting means and between said transacting means? and'isaid 
teller means. ■ r/^ 

Further, the present invention provides for a method of using electronic representations ofxurrency. or, 

25 electronicrepresentations of credit provided by at least one financial facility having a means for generating - . 
said electronic representations, and a teller means for issuing and accepting said electronic representations v ' 
and serving subscribers of said facility, comprising the steps of: generating said electronic representations : - . : 
of currency backed by demand deposits or generating said electronic representations of credit authoriza- '^-r- ^ i^^s;". 
tions; issuing to said subscribers and accepting from said subscribers electronic representations of .Currency ... v.iz 

30 or credit, wherein the issuance and acceptance is performed by said teller means at said financial facility; ?v . ; . , ^ 
and providing said subscribers with a transacting means for accepting said issued electronic representa- s^-..-, 
tions of currency or credit, and for transferring said electronic representations of currency or credff to both ' .^t.,.. .^^.^ 
other subscribers having said transacting means, and to said teller means. ^ . v,- 

The present invention provides a method of securely transferring economic value . inclutjing -'carrericy . 

35 and credit among' subscribers, among financial institutions, and between subscribers and financial institu- 
tions. The system provided is a paperless system whereby transactions can be-^arried out in both arr on- 
line and an off-line mode between subscribers. The system reduces the cost of central, electronic funds 
transfer systems by off loading much of the payments to off-line devices. The system provides for 
} inexpensive electronic transfers to reduce an institution's cost of managing paper cash, checks and coins. 

40 Further, the invention provides a user friendly electronic payment system that may be used reliably and 
securely for real time transfers of money between members of the general public, between members of the 
general public and commercial organizations, and between commercial organizations. The system may be 
integrated with a wide variety of data processing and data communication systems including currently 
available home banking services, Further, the system can be utilized with electronic money in the form of 

45 multiple currencies and in transactions of virtually any size denomination. Further the medium of economic 
exchange provided is fungible, easily transferable, undeniably redeemable, and secure from reuse, du- 
plication, and counterfeiting. 

The foregoing features and advantages of the invention are illustrative of those which can be achieved 
by the present invention and are not intended to be exhaustive or limiting of the possible advantages which 

50 can be realized. Thus, these and other features and advantages of the invention will be apparent from the 
description herein or can be learned from practicing the invention, both as embodied herieih or as modified 
in view of any variations which may be apparent to those skilled in the art. 

Sunnmary of Exemplary Embodiment 

55 [ 

To achieve the foregoing, and other objects, the methods and apparatus of the present invention 
employ a preferred embodiment in the form of an electronic - monetary system having (1) banks or financial 
institutions that are coupled to a money generator device for generating and issuing to subscribing 
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customers:electronic money including electronic currency backed by denriand deposits and electronic credit 
authorizations: (2) correspondent banks that accept and distribute the eiettronic rndney: (3) a plurality* of 
transaction devices ihat'.are used by subscribers for- stofihg electronic mbn^y, for perforhniiig rhori^y 
transactions with the. on -line systems of. the particip^tihg banks or for excharlging eleetrbnic rnoney with 
5 other likd transaction devices. in ,off- line- transactions: (4) teller -devices; assicbeiated with thfe iSsLiihg^'ahd' 
correspondent banks.- for -pfdcess handling and interfacing the ^transaction devides to the issuing and 
correspondent banks, and. for intei^acing' between the lssuihg, and cdi^respondeht banks theririselvefs; (5)^ a' 
clearing bank for balancing the electronic money accounts of the different issuing banks; (6) a data 
communicatiooa network for providing communications services? to all components bf the systerin: and (7) a 
70 security, arrangement for maintaining the integrity of the systerti, and for detecting counterfeiting and 
tampering within the system. 

In the preferred, .embodiment the functions of the' money geherating" devices, the tfahsactidn devices, 
and the teller devices- will;; be pierformed by a combination of tamper -proof computer = hardware and 
application software modules that may be networked together: Information is transmitted in an encrypted 
15 form to provide; security from unauthorized inspe.ctibn. T?he electronic rhoney is transmitted with digital 
signatures to provide authentication, and. security from modification or edurtterfeitihg; 

The electronic money exchanged by these devices may be an electronic repr&s*ehtatidr> of currency 'bi- 
credit. An .important aspect, of the; electronic currency is that it is the equivalent Of bank 'notes and is 
interchangeable with conventional paper money through claims on deposits in an issuing iD'ank, but dSn^ be 
20 withdrawn or deposited - both at an .issuing bank and at a correspondent bank-. However, only the issUihg 
banks can generate the electronic currency, and will be; liable ^foi- its redenription. 

-Jhe issuing banks later utilize inter.- bank- clearing and settling 'prbcesses to maintain the rrioh'etary 
balance in the banking system, as is currently practiced by today's banking industry. 

The electronic mpney representation's are fungible, universally accepted, and urid^ni ably redeem iable 
25 from the issuing banks, i.e.. they have the characteristics of money transactions. Td pfeiserve the integrity of 
the electronic monetary system, each exchange, of electronic money includes, along ^with other information; * 
data identifying the monetary, unit .of the credit or currency; (i.e., dollars, yenVeteO the 'arndunf by uriif of " 
credit or currency, and the bank issuing the .electronic credit or currency, and several digital signature's:- ' ' 

30 Sunpmary of The Invention - • 

..In accordance: vyith these: and. other objects of the invention;, a. brief sumnriary of 'the ^ present in ventibn ig 
presented. Some simplifications and omission's may be' made in the , following summary/ which is intended 
to highlight and introduce some aspects of the -firesent inventibn^ but not to limit its scope. Detdilfed 
35 descriptions of a preferred exemplary embodiment adequate to allow those of ordinary skill in th6 art to 
make and use the inventive concepts will follow in later sections. , - - 

According, to a broad aspect of the invention, an electronic monetary system provides for transactions 
utilizing electronic money including electronic, currency backed by demand deposits in a bank in lieu of 
cash transactions, and electronic credit authorizations. The invention comprises a money module for 
40 generating the electr-pnic money; a: money- module for issuing, distributing, and accepting the elebtronic 
money; and a money-.module for accepting, storing, and transferring the electronic money betweeh bther 
accepting money modules and between the accepting money, module: and the issuing money module: 

According tO; a further aspect of the invention, an electronic monetary • sy stein, is provided for 
implem,9n.tirig. and- maintaining electronic money which' includes electronic currency that is interchatigeable^" 
45 with conventiqnaj money through claims on deposits in. a bank, and -electronrc credit authorizations. 

The system includes. a plurality of issuing .banks; a generator for creating electronic money; teller 
modules coupled to the generator module, for performing teller transactions and for interfacing .with other - 
teller modules, such transactions including the accepting and the distributing: of the electronic money; a 
security system for providing the overall integrity of the electronic hnonetary systeim: a clearing and settling 
50 process for balancing the electronic money accounts of the separate issuing banks and for clearing the 
electronic: money issued by the issuing banks: and a plurality of transaction modules owned by authorized 
users, for transferring the electronic money between the transaction modules and between the transaction 
modules and the teller modules. 

In accordance with another aspect of the invention, the functions of the generator modules; th©*' 
55 transaction modules, and the teller modules will be performed by a combination of tamper -proof computer 
hardware. anc| -application software th^tm.ay be networked together. 

The . electronic money i^.exchanged by these modules, which may be an . electronic representation of 
currency backed by demand deposit accounts at the issuing bank or credit authorizations, may be ' 
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transmitted with digital signatures to provide security from unauthorized modification or counterfeiting. !n a 
preferred embodiment, security from counterfeiting and tampering is also provided by requiring the 
modules and the individual units of electronic money to be renewed periodically. Offending modules or 
counterfeit electronic money can be removed from circulation as soon as they are discovered. 
5 Briefly, a process in accordance with the invention comprises the steps of 

(1) providing a generating module to generate electronic representations of economic value backed by 
demand deposits or by a credit line; 

(2) providing a teller module to accept the generated electronic representations of economic value and to 
issue the electronic representations of economic value; 

70 (3) providing the authorized users with a transacting module for accepting, storing and transferring the 
electronic representations of economic exchange to other authorized users having the transacting module 
and to the teller processing module; 

(4) accepting and transferring the electronic representations of economic value to other authorized users 
having a transacting module and to the teller module: and 
75 (5) providing a security systenn to allow the transfer of electronic representations of economic value in a 
secure manner between the generating module, the teller module and the transacting module. 



Brief Description of the Drawings 

20 Other objects and advantages of the present invention will become more apparent by the.jaljpwing 
description with reference to accompanying drawings, in which: ,.1^ 
Figure 1 is a diagram illustrating general aspects of the invention; 

Figure 2 is a schematic diagram of the operative arrangement of the components, accordihg to the 

invention. ....... r-....-^^^^.. ,^ 

25 Figure 3 is a perspective diagram of several embodiments of external systems that may house, a- money . 

module, according to the invention. ;-7r 

Figure 4 is a block form diagram of a transaction money module, according to the invention. 

Figure 5 is a block form diagram of a Teller money module, according to the invention, 

Figure 6 is a block form diagram of a Money Generator module, according to the invention. 
30 Figure 7 is a block diagram of the network arrangement, according to the invention. . ; 

Figure 8 is a block diagram of a Network Sever, according to the- invention. 

Figure 9 is a flow diagram of the security system, according to the invention. 

Figure 10 is a block form diagram of a security server, according to the invention. ' ,^ . . 

Figures 1 1 - 24 are flow diagrams of accounting examples, according to the invention.- , , . 

35 Figure 25 a flow diagram of the Transaction Reconciliation System, according to the invention, . 

Figure 26 is a flow diagram of the Clearing System, according to the invention:. 

Figure 27 is a flow diagram of the Money Issued Reconciliation System, according to the. invention. , 

Figures 28-50A are flow charts of transaction examples, according to the invention. 

40 Disclosure of the Preferred Embodiment of the Invention 

The present invention contemplates an improved monetary system using electronic media to securely 
and reliably exchange economic value. The system can be implemented by integrating novel data 
processing systems with other procedures which can be implemented with the current worldwide banking 
45 systems. 

Throughout this description, "electronic money" may also be referred to by the abbreviation. "E-.M." 
Additionally, the term "bank" is used hereinafter to indicate any banking, financial institution or the like 
which is a participant of the present invention. 

Referring now to the drawings, wherein like numerals refer to like components, there is. disclosed in 

50 Figure 1, in block form, broad aspects of the preferred embodiment. In Fig. 1, the general relationship 
among the features of the system is shown. The system includes Issuing Banks 1 each,.having a Teller 
money module 5 and a Money Generator module 6; Correspondent Banks 2 each having a Teller money 
module 5; an electronic money Clearing Bank 3; a Certification Agency 28 and a plurality of Transaction 
money modules 4 owned by subscribers of the system. 

55 Electronic notes 11, the media for transferring electronic money, are generated by the Money Generator 
module 6 for an Issuing Bank 1. These notes 11 are then transferred by a Teller money module 5 to a 
subscriber utilizing a Transaction money module 4. Electronic notes 11 may be representations of currency 
or credit authorizations. For security reasons, all electronic notes 11 will expire after a preset time period. 



'tar 
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Once expired, the notes 11 must be redeemed at a participating barik for updated ones before they can be 
transferi'ed. 

An Issuing Baink 1 generates- arid distributes the electronic notes 11. and is liable fbr their redemption. 
An Issuing Bank 1 performst; deposits; withdrawals; payrhenits to loans arid ihquiries for other money 
5 modules. ■; v. 

A Correspondent Bank 2 \s d participating bank which distributes electronic money through acedunts it 
maintains at Issuing Banks 1, but does not generate any electronic- rtiohefy, and is hbt liable' fdf its 
redemption: Because it c'anndt g€iriefat6* any electronic money, the' Cdrrespohdeht Bank 2 in the preferred 
embodiment must make real-time requests of electronic money frorh an-a'ecdunt it mairitains^ ait an Issuing 
70 Bank 1 whenever a subscriber wishes to withdraw eleGtrdhic ifndhey at ^ Gon-espondent Bank 2. 

Conversely, a - Correspondent = Bank 2 deposits all electronic rtioriey deposited by subscribers, to the 
accounts the Correspondent Bank 2 holds at Issuing Banks 1. These accounts wil|i:be defscribe'd- hereinafter. 
A Corresponderit Bank 2i like an Issuing Bank 1, will- perform deposits withdrawals, paymeiits to loans and 
bank inquiries. 

15 . Notably, an- Issuing Bank 1 may also be a Gdrrespondeht Bank 2 for the monetary units that it does not 
generate. For example, an Issiaihg Bahk-I for electronic dollar- notes 11- may be a Corre's'pdhdent; Bank 2 for 
electronic notes 11 of yen. marks, issued by other banks etc. 

It is also important to note that system of the invention can function without cor'reispond'ent Banks 2, For ' 
example, a subscriber can eliminate the use of a Correspondent Bank 2 by communicating directly with 

20 his/her Issuing i Bank when making a deposit; withdrawal. et6. Corre's pendent Banks 2 are ihcluded \ti \he 
preferred embodiment for the practical purpose of expanding distributiori of the' system while reducing-the 
risks that are inherent in any banking system. such-as4he: riskjs caused by the collapse' of a bank issuing 
money. . . , . . 

The Clearing Bank 3 is utilized when more than one bank is issuing electronic money. According to' the 

25 invention, it is anticipated that more, than ' one bank will be issuing electronic ^mdn^y. Thus.' the Clearing 
Bank 3 is provided to clear the electronic money deposited and to balance accounts it nriaintains for the 
Issuing Banks l.iThe.^Clearihg Bank 3 maintains demand accounts for each Issu Bank Lin the^ system;* < 
The CertificationvvAgency :28, is^the centerpiece ^of-.-the? system ^ security/* It provides' a process:; that 
"certifies" the validity ofja money rriodule for a certairi period of tifne by issuing a certificate- to each monev 

30 module. A money module 'must^haVei'a; valid certificate in order to- be; able to transact- witH :other money 
modules 4. 5. 6. ■ .\' : • i . : 

Before the certificate expires.*' . it-vmust^ be - updated so that a' subscrib'eMcan' continue' to use his/her 
transaction money module- 4. This process makes users of the system establish • peHodic dontact -with the 
Certification Agency 28, / , ' , • . -v - ' : . ■ 

35 Periodic contact allows for faster response when tampering with the money modules of the system is 
detected. To this end. the Certification Agency .28 also provides: a list iof offending on 'ciompromised money 
modules to other money mddules: so that transactions with the bad units may be blocked. 

The components shown .'in Figure 1 are . best understood by = ref erring to the system'^ ' operative 
arrangement illustrated in Figure 2. As illustrated in Figure 2, the preferred embodiment provides for 

40 supplements to the current banking systems that include the following additional: ^rbmpohehts: a plurality of 
the Transaction money modules 4. the Teller money modules 5, and the honey Generator modules 6. for 
creating, transferring and storing the electronic .notes 11. (money); a Clearing Systenh 13 to balance the 
accounts of: banks ..issuing currency knd credit; -a security system 21 to maintain the integrity of the 
electrdnie notes t1;%the current, bahkirig system$i 20;va network 25 (exemplified by. ^thd- lines interconnecting 

46 modules and systems) to mediate transactions between money modules 4,5,6, the participating banks 1,2.3. 
of System' 20 and. the security system 21; a Transaction Reconciliation system 22 to detect money, module 
malfunctions, and. insidei: . tampering of the .system;: a* Money:. Issued iReconcili'afion. System 23 to detect 
counterfeiting and reuse of electronic money; and a Money Position System 24 to keep track of the 
electronic.- money in circulation. . . . ; 

50 Playing mayor role in the ; prieferred ernbodiment are three classes of "money modules" for creating, 
storing., and transferring the. electronic objects that represent economic value*. These include the. Transaction 
money modules 4. the Teller naoney modules 5, and the Money Generator moduliss 6. It is contemplated 
that these money , modules 4i5.6. will be a combination, of =tam per - proof hardware and - application software 
that are meant to be components of a larger processing erivironmient. 

55 Referring, to the top, rights hand side of Figure 2. a Transaction:. money module 4 containing: electronic 
notes 11 stored therein (not shown) may be used to exchange foreign currency or make a paynient with 
another Transaction, money module 4,: using a secure, encrypted protocol either by a telephonic link, or a 
proximate communication link. Because it/is contemplated that an .electronic note 11 will be fungible, i.e., it - • 
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can be broken into any desired amount, the amount transacted between the Transaction money modules 4 
may be of any amount up to the amount stored in the payor's Transaction money module 4. 

A payee's Transaction money module 4 that has received the electronic note 11 as a payment may, in 
turn, be used to transfer all or any amount of the electronic money contained therein to another subscriber's 
5 Transaction money module 4. Alternatively, the payee may deposit the electronic money into his/her bank 
account. 

The value of the electronic money stored in the Transaction money module 4 may also be redeemed at 
any participating bank (e.g., Correspondent Bank 2 or Issuing Bank 1) for paper money by transferring any 
amount of the electronic money to a bank's Teller money module 5, whereby a teller or an Automated 

70 Teller Machine (ATM) will return an equal amount of paper money. Naturally, it is anticipated that paper 
money may also be exchanged for equal valued electronic money. 

As will be appreciated, the Transaction money module 4 may be configured to make deposits, 
withdrawals, loan payments, inquiries and exchanges of currencies of electronic notes 11 directly through a 
Teller money module 5 at an Issuing 1 or Correspondent Bank 2 or remotely through a telephonic 

75 connection to an Issuing 1 or Correspondent Bank 2 Teller money module 5 (thereby providing, among 
other things, the transactions not available in current home banking systems). Upon a request to transact 
with a bank, the Teller money module 5 mediates the transactions for the subscriber's bank account as well 
as the banking system's electronic money accounts. 
^ It should be noted that a subscriber will not be required to maintain a bank account in order to. own and 
i ] 20 use a Transaction money module 4. For instance, a subscriber may obtain a stand-alone computing 
device that contains a Transaction money module 4 and use the device only in off-line peer-fto*r.:peer 
transactions with other devices containing a Transaction money module 4, such as a merchant's poi^ntTOl.- 
sale terminal. Of course, the merchant may then transfer the electronic money to another commercial 
organization to meet its obligations, or it may deposit the electronic money at its own bank. : i 

25 In the preferred embodiment, electronic money deposited at any Issuing Bank 1 other than the; OFtginaK, 
Issuing Bank 1 itself will subsequently be settled for value with the original Issuing Bank 1 through the 
central clearing and settling process performed by the Clearing System 13. It is anticipated that the clearing 
and settling processes will be managed by the Clearing Bank 3 (Figure 1). Each Issuing Bank 1« Teller 
money module 5 sends all the electronic notes 11 deposited at its bank but issued from other Issuing^Banks 

30 1 to the Clearing Bank 3 in order to settle for the value posted to their customers' accounts. 

. When a withdrawal, an exchange for foreign currencies, an exchange of paper cash for electronic 
money, or an updating of the electronic money occurs, the Money Generator module 6 Rgure 2. creates 
and digitally signs electronic objects having economic value - either currency or credit notes 1.1 (Figure. 1) 
- that are to be sent to the Transaction money modules 4 through the participating bank's Teller money 

35 modules 5 in the form of a packet of electronic notes 11. As mentioned above, the electronic currency notes 
11 are the equivalent of bank notes that are backed by deposits, and can. be. traded between Transaction 
money, modules 4. . , 

During the withdrawal transaction, the Teller money module 5 and the Transaction money module 4 
'^J may establish a communications link using an encrypted protocol to securely transfer the notes 11 from the 

40 Teller money module 5 to the Transaction money module 4. 

Records of the notes 11 generated and conveyed by the Money Generator module ft-^are sent to the -. 
local bank's Transaction Reconciliation System 22 and an Issuing Bank's 1 Money Issued Reconciliation 
System 23 for maintaining statistical and housekeeping functions. Records of the electronic notes 11 
cleared and settled at the Clearing Bank 3 are also provided to the Money Issued Reconciliation System 23 

45 . From these compilations, a financial position of the system can be produced by the Money Position 
System 24. 

Discrepancies and malfunctions are reported to the Security System 21 which downloads the lists of 
problem money modules to all money modules in the system when they are connected to the Network 25. 
By carrying this list, a Transaction money module 4 will be inhibited from transacting with other suspect 
50 Transaction money modules 4. 

Having thus provided in overview of the preferred embodiment, there will now follow a more detailed 
description of the individual elements and the transactions between them. 

Money modules 

55 ~ 

Figure 3 provides several embodiments of external systems or devices for housing money modules. 
In the preferred embodiment, the external system or device will typically contain data display means, 
data input- means, data processing means, memory storage means, direct connection or contactless 
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bidirectional communications means, ancJ 'the money module packagied iri a tamper -probf hbusing.' all 
interfaced by suitable nheans for infornriation transfer, such as are well known in the art/ ■ 

As. will be understood, a money module may be embodied as a nnodutar xompibrient of any larger 
processing environment while still performing, the same functions; For exalniDle; Ti-ahsacti oh' money modules 
5 4 may work as coprocessors embedded Jn personal portable computing devices like' the Hevvlett ^ Packard 
95LX. or as co - processors in mainframe computers, workstations, point-of-sale terminals or teleiiihdne 
devices (fixed or portable) connected to a network. i . :■ . • 

A Teller money module 5 may be embodied as a cdprocfessbr iri the bank's financial computer 
systems. The Money Generator module 6 could be a separate processing uffit networked: to" the bank, a 
70 CO -processor in a general purpose^computer, or it may be combined with- ah Issuing Bank's 1 teller 
money module 5 in a larger processor. . > 

Because it is anticipated that a money "module will be implemerited ih a 'separat# processing deviel; it 
is assumed , that corresponding interface circuitry would be provided in the host prdcessing device to 
provide communication between the processing device and the money hrtbdule^ 
75 . Notably, all. classes of money modules contemplated- by'the invention may be implerriehfed program - 
matically or by direct electrical connection-through customi2ed integrated eircuitg; 6Y a cdmbiha'tidri of bdth;^ 
using any of the methods known in the industry for "providing the fuilctibns described below without 
departing from the teachings of the invention. Those skilled in the art wi 11= appreciate that frbm the disclosure 
of-th9 invention provided herein, bommercial semiconducto'r integrated-' cir'cuif tech no logy 
20 numerQus alternatives. for actual implementation of the: inventive-func<iohs of the nnidhey mbdule that 'would 
still be within the scope :of the . invention.-! ^ ' ' • .r, : . • ; 

Transaction Moneiy Module , ■ 

25 In one embodiment, the Transactioh money! module- 4 nniay be imbedded in ah^/ corriputer of any size or 
usei like, those iserving.as.general purpose computers or work ^stations, to provide fuiictions not limited to' 
E-M transaction; use. This Jatter. application: will. eillbw for such u^es as^ real^lime. off-line payments * 
between ipeTSonal; . computing devices; ;br% on - line: payments for; network services such as ' information 
retrieval, telephone: talis/ or for. ^ ': : • 

30 In another embodiment., the Transaction' money module 4 may be irtlbedded'in an' iridivfdual hahd-^held 
integratedr. circuit, 'wni.t. - such as a personalized hand - held : computer that may be readily^ c^rrred by -an 
individual as though ^t were a- wallet; As an illustratidn. the device of the preferred embbdimerit'rhay'ihclijde 
a keyboardi :^ pen or stylus, a- touch screen or voice recognition circuitry as a data input m^ahs; ah 
alphanumeric LCD dot matrix display as a display means, an infrared optical transceiver as ^ ebritactl^Ss 

35 bidirectional communications means,, and an RJ^.11 'telephone jack coupled to rhoderti drcuitry a's-a= 
telephonic .communi.Gations , means... Additionally, the device may alsd iriclude^ varibuis eie'ctr^dhiG processing^ 
and storage means for providing calculator capabilities, for storage and processing data of ihh owner, etc. 

; ItJs important to note that the particular design of the. external deS/ice iS not CNtiCalati'the'* invehtidh.- and 
oth^r technologies suitable for. accomplishing the foregoing ;funGtions may alSiD'-be' Used*. Fbr- example", ah 

40 LED instead of an LCD display panel may be used; radio; infra red; indudtive- dr c^pa^itlve febhl'mUriication^ 
methods may be used instead of-.direct eonn'ectioh /optical communications methods :may be usad; 'etc. - = ' 

In;, general, it is . anticipated; that .any; Transaction money nnod'ule 4. owned by a subscriber' will be 
embpdied. in ^ self-contained, tamper -resistaiit unit that contains corirtpohents which are 'difficult to 
access, and thus prevent any person Jrom improperly :texamining,..cbunferfeiting or modifying any of its 

45 concepts or arrangements.. ,Forr jexample, integrated senriicbnductor. circuits, whose corifehts are difficult to 
examine, encased in a tamper -resistant package such as that formed by an epoxy or plastic lamihatidh 
may pcQvid^ a high degree Qf/phy.sieal .security, while providing: the necessary storage, computation; timing, 
andr.pther data processing functions. . . . , . 

[Hoyyeyer, the imention. i§ not limited to. any; partieulah tamper - resistance means, Inasnhuch there are*' 

50 a number of methods known in the industry for providing such security. Such tamper - resistance Will also ' 
preyent/the pw.nerj who can control on ty some .of the internal, operations of the Transaction moheiy rnodui^s 
4. from certain accesses to thereby provide security . from abuse to other relevant institutions ahd 
individuals. 

Each Transaction money module 4 will have a way of ensuring its own association with' a particular 
55 subscriber, so that its use by other individuals may be limited. In addition to the use of Personalized 
Identification Number (PIN) methods that are well known in the art, the Transaction money module 4 may 
also include: .means, such as ^ fingerprint. reader, voiceprint. analyzer, written: signature analyzer, or other 
so-called biometrics means, to determine the physical identity of an authorized subscriber. 
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Additionally, the Transaction nnoney module 4 may utilize personalized interactive proofs using ques - 
tions that only a true owner would be able to correctly answer, such as the owner's mother's maiden name, 
his/her favorite color, etc. Any such techniques may provide additional security for organizations; and may 
also be to the advantage of the authorized user since such security can protect the subscriber's data from 
5 inspection and use by someone else coming into possession of the Transaction money module 4. 

Because the Transaction money module 4 can take on a variety of physical representations, it will be 
described by the functions performed in addition to the pertinent physical characteristics of a preferred 
embodiment. 

Referring now to Fig, 4, a Transaction money module 4 is shown diagrammatically in block form. 

10 Specifically, a Transaction money module 4 has (1) an. external interface 30 that interfaces the Transaction 
money module 4 to the module's data processing means, the input/output means (human interface) and the 
communications circuitry of the external device; (2) a session manager 31 to control and commit (i.e., 
finalize) or abort a transaction session; (3) a transactor 32 to manage application functions; and (4) a money 
holder 38 to contain and manage the electronic representations of money. 

75 According to the invention, the following application functions may be implemented in the preferred - 
embodiment of the present invention: 

The To Subscriber application 33 performs the function of comparing the owner identification char- 
acteristics. such as a user's personal identification number (PIN) and biometrics characteristic (e.g.. 
fingerprint, voiceprint, etc.), that are stored in the memory of the Transaction money module 4. ta^tt^ose of 

20 the individual who is attempting to gain access to the Transaction money module 4. After thJ8,-pyrpper 
ownership is verified, the Transaction money module 4 nnay be activated, and the user is allowed certain 
accesses to the Transaction money module's 4 stored contents. Messages to the subscriber, and 
subscriber inquiries as to the information contained within the Transaction money module 4 are also 
handled by this application function. 

25 The To Teller application 34 interfaces the Transaction money module 4 to the Teller money rnodules.S., 
for initiating and performing deposit, withdrawal, loan payment transactions, and bank inquiries with- such , 
Teller money modules 5. ^ v; 

The Pay/Exchange application 35 supervises the sending and receiving of electronic notes 11 between>,-^ 
Transaction money modules 4, managing the process in which the electronic notes 11 are properly 

30 "packaged" as to amount, digital signatures, etc. This application provides that the electronic notes; 11 aret- 
transferred in a recognized, valid format. Notably, this is the application that allows a money module tO: 
perform payments and foreign exchanges. Without this application in the preferred embodiment, a-. 
Transaction money module. 4 cannot make a payment to another Transaction money module 4. 

The Tran Log Mgr. application 36 provides, the management and overseeing of a Ipg-^tthat recQcds 

35 completed transactions undertaken by the money module. For each completed transfer of electronic money, 
an illustrative Tran Log records: ^r- 

(1) the type of transfer (i.e.. payment, deposit, foreign exchange, etc.). 

(2) the date of transfer, 

(3) the amount of transfer, 

40 (4) the issuing Bank 1 identifier 

(5) the note identifier. 

(6) the monetary unit, 

(7) the identifier of the other money module involved in the transaction, and for deposits, withdrawals and 
loan payments: 

45 (8) the bank account number. 

(9) the bank identifier, and 

(10) the amount of the transaction. 

In the preferred embodiment, every money module will have an identifier. A money module identifier 
may be thought of as the "serial number" of the money module and is never changed, 

50 It is anticipated that a subscriber may have access to several of the fields of data stored in the Tran Log 
application, such as histories of the amount, date, and type of transfer. Information as to the; expiration date 
of a certificate may also be accessed by the subscriber so that he/she will be informed as to the need to 
update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a list of money module identifiers that are known to have 

55 been generally compromised. In particular, this is a list that is distributed to each money module when it 
communicates with the Network 25, and is a list of money modules that have passed an invalid or 
counterfeit electronic note 11 or have performed acts deemed detrimental to the system. 



9 



BNSDOCtD:<eP 0542298A2> 



EP 0 542 298 A2 



Whdn ■ establishing a session between money modules, each rnoriiey module checks its lisit ^bf^'bad 
money' modules to see if the other is an offending money module; If the other nrioney module'sTidentifier 
appears oh the list, the eomnhuhieatioh is broken loff. - • • .■ , . v:.' ^ 

This applidatiiDh al$6 pfovideiS the^proceSS for obtaining the certificate unique to the money nnodule, fdr 
5 synchronizing thei iriterrial'do'ck. a^^^ . . 

The Note- Directory 39 -3pplifcatibrt p6rfbrms the fuhetidn of kei6pin^ track of "the location, identification 
and Value of the elettrdnio notes 11 stored Within" the money rtiodulS-. A riptfe'lli whether it is'an "el^ctfonie 
currency note or an electronic credit note, is the basic unit of electronic money. It is the electronic object 
representing the economic;' value, the electronic bits that cbritaiin the amount, expiration date, riote identifier 
10 etc: (described' in- detail b'elbWj that gets digitally signed (described belowy and ericrypted when being 
transferred. Both- electron ie currenty -notes- -1 1 arid electronic' Credit notes 11 may be located by the Note 
Directory 391 ■* ^ - - ' . 

The Note Director^' Vp'plicatr^^ updates summary totals of 'the current- Amount of- electronic notes 11 = 
(both currency and credit), by monetary unit aifter every transfer/ A date of - expirafio'n-. a note identification ' 
15 number and an Issuing Bank identifier is also recorded With the location of; esich note 11. 

In summary, the Note Directory 39 keeps track of the note identification- nunriber, the Issuing Bank 1 
identifier, the date-of-expiraition^of thfe note 11. the locatioh df the note 11- as Stored in the Transaction 
money rtibdul^ 4. and the current ahnbUrit of the totial value of . the notes 11 stored for each rirtonetary unit. 
These records^ are maintained for both electrbhiG currency and- electronic credit. For a credit note 11, the 
20 account number of the credit line is alsd main ' 

The Notes application 40 manages the storage of the representations of : the electron rc-: notes-; It" 
themselves, both currency arid credit not'6s"-.1i ; This ap^ alsd gerierates the transfers wlhen'notes'^vl 1- . 

are to be conveyed. - • 1/;. . 

The Packet Manager application 41 manages the construction and formatting' 6f a packet':of*eJec'trdhiG-.-^ 
25 notes 11 that are to be transferred" to anothgr money' module. For exanriple'.' the Packet ; Manager' 41 will 
utilize ah algbrithnn so thai thie least number) of electronic notes 11 are used to. fulfill the requested amount - 
of transfer, with the earliest dated electronic notes 11 being used first. Alternatively, when a packetiofmoteis ■ 
11 is transferred to" th'6' receiving; moriey-' module) '^^^^^ Packet ^:Manager:'41 application "disassembles'^^th^ 
packet. verifyihg'the-da:te- and'separating' th'endiata" fields that repi^esent-the differem electronic notes"11. . • 
30 The formatted packet gets^sever^ fields- appended to. it when'ei^ctroriiq notes' It ^are "assembled."^ 
An identifien daXa field provides the'iii'dicia that identifiies: it as a packet. Additionally, data fields forrthe tbtal. 
value^bf th^' notes 11. the number of notes 11*,' and the individual locations 'of tho notes 11 are-.provi^edT^-:* 

The Verifier- appliemion 42 verifies thati a received packet ' contains- valid electronic notes 11 before a- 
receiving- rhoriey ririodule accepts them. The ^Verifier 42 al^o Checks, that the total amount received is equal 
35 to the sum of the electrohic hotes 1t thhr are to be* transferred. If the toiar ahnount and. the individual 
electronic notes 11 are valid, an acknowledgment is returned to allow for- bom pletiori of the* transfer:-. 
Otherwise, an "invalid" message is sent.'and. the transfer may be aborted. 

Services applications that are provided fall under two categories: Clock/Timer 43 arid 'Gryptographyi The 
Clock/Timer 43 provides output pulses for controlling a transaction timeout, such as the time, between the 
40 sending of a message and the return of a corresponding message. ■ ~ . i . . ... - 

As will be appreciated, when two money modules are communicating, they may be rrionitoFing a :tifne - 
out protocol. For example, after a first money module has sent a message to a second. money; modulfe.ahe 
Session^ Manager 31 of the firsts mon^y module^ ("A") may set a timer for a rep!y;'if;-the.Trafisaeton'32 
indicates that a reply is required. The Session Manager 31 may also number the message sent... This 
45 number would appear in the reply message from the Session Manager 31 of= the '.second mbney rrtodule 

("B"). - ■ ^ ; , 

If the timer expires before the message has been received, then Session . Manager A 31i;.will;: query 
Session Manager B 31 to determihe if the transaction is still running -.in B. If B does not reply then Session 
Manager A 31 will abort the transaction. If a reply is received that the Iransactiori' is proceeding, .then! the 

50 timer will be reset to a new time. If A queries B a- predetermined number of times without receiving a reply 
to the original message, then A may ^bort the ti^ansactibn; ' . 

Separately, 'this application also maintains" the current date and itime. both for user display and for 
verifying that an electronic note 11 to be received is not an expired one. along with other general clock = . 
functions that are comnionly used in the industry. . 

55 The Cryptography application contains- a- Public Key 44 operation, a Symmetric Key 45 operation., and a 
Random Number Generator 46. While the tamper - resistance of the Transaction . money module 4 and its 
components makes it difficult for a person to = modify the structure, of the device or its :Contents. .known: 
cryptographic techniques are also employed to provide secure communications and payment transfers 
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between money modules. 

Public key cryptography 44. as is well known in the art, may be employed by this application to provide 
public key digital signatures, which are called "digital signatures" or simply "signatures" for brevity. The 
data in electronic notes 11, may be represented by a digital number. The electronic notes 11, are signed by 
5 digital signatures formed from this number. A digital signature can then be checked as corresponding to a 
particular message by anyone knowing the corresponding public key, which in the preferred embodiment 
would be all other money modules. 

This application provides each money module with the ability to check the digital signature for 
authenticity. A money module receiving the digitally signed electronic note 11 can in turn sign and transfer 
70 it to others, who could also check, sign and distribute it. 

Because of the "one way" nature and computational complexity of public -key digital signatures, it is 
thought to be infeasible to decipher and duplicate them within a feasible period of time, making such a 
security system resistant to forgery. 

Lastly, this application also creates new public and private keys when needed. 
75 Symmetric Key cryptography 45 provides private key algorithms that are well known in the art, for 
individual session security and privacy between money modules. In the preferred embodiment, this 
application provides encryption/decryption means in order to secure information being exchanged between 
two money modules. 

Any well known symmetric key cryptography technique, such as the National Data Encryption. ^Standard 
20 (DES) system or other cryptography techniques, may be provided in this application. For exampl^, due to 
the increasing interest in providing cryptographically secured communications, manufacturers are providing 
various semiconductor integrated circuit devices which perform the encryption and decryptiot^.,QL.data. 
Cylink corporation's CI DEC data encryption devices are examples of commercially available 
encryption/decryption circuitry that would be suitable in the present invention for this application.. DiJe toJbe., 
25 federally mandated use of the DES algorithm, devices such as these are widely utilized to implemerit4hat 
algorithm. 

It is important to note that the details of the particular cryptographic methodology utilized by the.>money ,: 
modules are not critical and are not limited to a particular cryptographic technique. - 

The Random Number Generator 46 generates random like numbers for creating new public/private keys. . 
30 for the Public Key application 44 and new private keys for the Symmetric Key 45 application. This-^r 
application is utilized to vary in an unpredictable way the generation of temporary session keys. ^ 

Circuitry for providing such random number generation capability are well known in the . art. For.r 
instance, a circuit utilizing a "noisy" diode may provide random values, as is well known in the industry.. 
Random numbers may also be provided by a pseudorandom number generator circuit which implement? a 
35 mathematical algorithm, such as the power - residue algorithm, that generates apparently., random values 
from a "seed" number. The use of clocks or counters provides another often :us,ed source, of random. data. 
As will be understood, the Random Number Generator 46 may use techniques that are well known to a 
person of ordinary skill in the art to generate the temporary numbers, and thus need not . be. further, 
described, 

40 It should be further understood that the foregoing functions disclosed herein may be performed by 
known programming techniques and/or dedicated hardware and in some cases may be combination of both 
or shared resources from each. As may be appreciated by a person skilled in the art, many changes in form 
and detail can be made in dependance on specific application requirements without departing from the 
essential features of the money modules. 



45 



Teller money module 



The banking systems 20 of both the Issuing Banks 1 and the Correspondent Banks 2 interface to the 
system of the invention through a Teller money module 5. The Teller money module 5 may be imbedded in 

50 any general purpose computer or workstation. The particular design of the Teller money module 5, like the 
Transaction money module 4. may be implemented in readily known programming techniques or dedicated 
computer hardware, or a combination of both. As will be appreciated by a person skilled in the- art, various 
designs of the Teller money module 5 may be employed to implement the functions described herein. 

The details of one embodiment of the Teller money module 5 is shown in block form, in Figure 5. The 

55 Teller money module 5 contains many of the same components and application functions of the Transaction 
money module 4 described above. Therefore, the identical components will only be repeated briefly here, 
while the distinguishing components will be fully described. It should be noted that the Teller money 
module 5. like other money modules of- the system, is also contained within a tamper -proof enclosure of 



11 



BNS0OCI0:<£P 054229aA2> 



EP 0 542 298 A2 



the type common in the industry, so as to ensure the necessary security involved. • v . 

The Teller money module 5 contains ari External Iriterfacef 30, a Session Manager 3i, a Transactor 32 
arid a Money- Holder 38 that perform similar functions to the cdrrespohdihg components in the Trdhsaction 
money rtiodule 4 described above; ' 

5 Briefly, the External Interface 30 'iht^iiace's th^* Teller money module 5 to other procefesirig arid 
comrtiiinicatidns means withiri the teller phoney mbdule 5 host processor; the Session Manager 31 acits to 
control and commit (i.e., finalize) or abort a transaction session between the Teller 'mbhey module 5 and 
another money module; the Money Holder- 38 riianages thei storih^g arid retrieval of Slecti-oriic money; and 
the Transactor 32 manages the^ application functions of a To Teller 34. the Tran Log Mgr. 38. the Mairitaih 

w Security 37. the To Bank 47, a To Money Generator 48. and the To Trahsactidn 49. 

The following list describes in brief, the applications contained in thd Teller rhbriey rhodule 5 that are 
functionally identical to the applications' found iri the Transaetidn ytiorifey nnbdule 4: 

- To Teller 34: Interfaces deposit and withdrawal functions to another Teller nhoriey module 5 . 

- Tran Log Mgr. 36: Trarisaetion log manager for recording Irarisactioh details;' 

75 - Maintain Security, 37: Manaiges the list of cbalfDrohhised mbniey nriodules. ajDplies for certificates, 
synchronizes the clocks, and m&nages the creation of new digital keys. 
• - Note Directory 39: Keeps track of the- location, valu^ arid iderilification of nbtes 11 by monetary unit. 
Summary totals are also maintained. 

- Notes 40: Manages storage for the electrOnieshot'es f1 of exchange,- and creates the transfers for the 
20 nbtes 11- ■ / . v / ;^ : 

^ Packet Manager 41: M^Sriages the assembly and dissemblydfd packet ^tdb'e transferred' to a -d iff ^rent- 
money module. ... . -: :■ • . " >■ :;...;- 

'•i^- Verifier 42: Verifies that a recei\?6d packet contains valid ^electronic notes 11: - 

- Clock/Timer 43: Gbritro'ls transactiori timeout, eixpireitidri of 'the of- 'the' electrbriic note's; I'l .'- 
25 expiration' of the certificate; 'and general clock functions--' *^ ' - ' ■ 

- Cryptography 

(i) Public key 44:'used for sighatures tb sigh and validate notes 11 and to 's^t up a secure transaction 
session. = : . .. . . . . , 

(ii) Symmetric key-* 45: Controls the security of a trarisactibn^Se^^^^ . • 

30 (iii) Random, nurinber ^enei'ator' 46:' Generates rartdbrti^like numbers for- n^w 'cryptographic keys* 

Some of the distinguishing;applieations'are the To Bank- 47 arid To* Transaction 49 a^plieatioris. The To 
Bank- alDplicatioh; 47- provides the; interfacing means whereby-fhe Tellfef rtibney thoduliB" 5 bari^'p'e'rfbSrn 
exehainges of data for inquiries arid accbunt postings with the on - line systems of a bank. This application 
is also utilized for crosschecking the customer's acbourit number with the' accounts arid type of trarisactibn ■ 
35 being requested. ' 

The To Transaction application 49 performs deposits.- withdrawals and payments tb " loans: -This 
application operates wheriever a- Teller money module 5 is frarisaeting with- a subscriber's Tra'nsadtion" 
money module 4. . . . ' 

As mentioned above, a Teller money module 5 may be associated with an Issuing. Bank 1 -or a 
40 Correspondent Barik. 2i When Teller money module 5 is associated" with^ a Cb/respbrident Bah 2, it is 
utilized for iritermediating - deposits, withdrawals, and payrnerits to loan accbunts b&tWeen a Transaction' 
money 'module.' 4i the Correspbndenf Bank's 2 on-line systems, and ari Teller money rhodule & at an 
Issuing Bank 1. - : ., 

When operating in an Issuing Bank 1 mode, the Teller money rtiodule 5 is used for intermediatirig 
45 deposits, withdrawals, and payments to loan accounts between other money modules and the Issuing 
Bank's 1 on-line systems. Additionally, when the Teller money module 5 is performing in an Issuing Barik 
1 mode, a To Money Generator application 48 may be employed when requesting new notes 11. 

Basically, the To Money Generator application 48 performs bankirig functions dealirig with requests for 
electronic notes 11.. It interfaces an Issuing Bank's 1 Teller money module 5 to a Money Generator Module 
50 6. . 

All of the other elements performed in an Issuing Bank's 1 Teller money module 5 ^are essentially 
identical to the similarly named componerits and application functions described above. 

Money ^Generator Module 

55 ^~ \ 

Figure 6M's.a block diagram illustrating the appiicatiort functions of a Money Generator module 6. Money 
Generator: modules 6 provide the nriechanism thait Issuing' Banks 1 utilize to issue electronic mon^y. A- 
Money Generator module S is also encased in a tamper ^ re'sistant package for the same security reasons 
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stated above for other money modules. 

A Money Generator module 6 generates the electronic money (in the form of electronic notes 11. to be 
described in further detail below), and distributes them to other money modules through the Teller money 
module 5 of an issuing Bank 1. The Money Generator module 6 includes a unique application not present in. 
5 other money modules for responding to requests for electronic money. This is the Money Creator 
application 50. 

The Money Creator application 50 creates and formats the electronic objects representing value - 
either currency backed by .demand deposits, or credit authorizations - and digitally signs these "electronic 
notes 11" using public key cryptography in conjunction with its secret key. so that it may be sent to an 
10 Issuing Bank's Teller money module 5. 

Notably, in a Money Generator module 6 the To Bank application 47 notifies the bank systems of any 
irregularities, off-loads transaction records in the Tran Log to the Transaction Reconciliation System 22 
and transfers electronic notes 11 to the Money Issued Reconciliation System 23. All of the other 
applications of the Money Generator module 6 are identical to the similarly named applications of the 
75 money modules described above. 

The Network 



According to one embodiment of the invention, the individual components of the present invention may 

20 communicate over a Network 25. as shown in Figure 7. The Network 25 will link together the Issuing Banks 
1, Correspondent Banks 2, the Clearing Bank 3 and the Certification Agency 8. - 

Transaction money modules 4 may be coupled to the Network 25 over the telephone exchange^or via 
special terminal facilities at bank locations (e.g., additional contactless or cable connections at an ATM 
booth). A communication layer will carry transaction requests (e.g., deposits, withdrawals), packets-rOf.-.ncites:-i 

25 11 and new certificates securely across the Network 25. In the preferred embodiment, the Network 25^ will, 
also provide directories of financial' services, and update the money module clocks and the bad money 
module list of all money modules. r^v 

As will be understood, the Network 25 may use well known data link or communications systems and 
techniques that utilize, for example, telephone lines, fiber-optic land lines, and satellites, and that include 

30 connective, timing and control software and circuitry for allowing access and transmitting digital information. 
The Network 25 may use commercially available protocols and operating techniques such as those set forth 
by the International Standards Organization ("ISO") for Open Systems Interconnect network standards. It is 
important to note that the particular design of the Network 25 is not critical and suitable technologies, for 
accomplishing the foregoing data communications functions may be used. . ■ v -.r 

35 Each entity (Banks 1 and 2, Certifying Agency. 28, or Clearing Bank 3) is also assumed to have an 
individual local network 16, 17. 18 and a gateway to the larger system Network, 25. The larger. Netw.ork 25 
will provide directory services for the routing of messages to connect to the appropriate local network .16, 
17, 18. The local network 16, 17, 18 has the responsibility of routing messages to the correct money 
module or Security Server 27. A Security Server 27 is associated with each participatirig bank and the 

40 Certification Agency 28. and is used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of the Network 25 generally, indicating that money- 
modules of any participating bank may be intercoupled to the money modules of other banks and financial 
institutions, or another subscriber's Transaction money module 4 via a communications link directly 
connected into switching and processing centers and alternatively connected to a local network 16, 17. 18 

45 at each entity. 

A money module need only identify the local network 16. 17. 18 destination (typically a bank 
subnetwork) for the transmission of most messages. The local network 16, 17, 18 will route the message to 
an appropriate money module for establishing a session. Once a session is established, the Network 25 
directs all messages between the two money modules. The Network 25 also controls messages between 
50 money modules and Security Servers 27. 

Transaction money modules 4 may communicate over the Network 25 for deposits, withdrawals, 
payments to loan accounts, updates or inquiries. The Teller 5 and Money Generator modules 6 will sign on 
the Network 25 periodically to update security information. The sign -on will be initiated by the money 
module Session Manager 31, or by the bank Security Server 27 if recertification is required or if there are 
55 changes to the bad money module list. 

A bank services directory may be available to the money modules primarily for updating the electronic 
notes 11 and performing foreign exchange. A list of participating banks for either service will be available 
from the Network 25. 
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In the preferred embodiment, the Network 25 will provide time services' to the individual compbhents of 
the present iriventiDri. Transaction -4. Teller 5 and Money Generator - nriddules 6 and Seeurity Server 27 
clocks may be updated from a Networ'k SetVer 26 in the Network 25' every time that the respective mdhey 
module acceisses the Metwork 25. . : • 

5 Network- Servers '26 may provide' the money module services described below-' and galeWay services' to- 
the local networks 16. 17, 18. The application functions of the preferred embodiment of the Network Server 
26 are shown in the block diagram of Figure 8. The folibwing application fundtidns are cont'e'm plated fo'r^ the 
Network Sever 26: * • - 

(1) E)?terna! interface 56 - a communications layer which' interfaces to the Network 25;- and ' 
10 (2) Communication Session Manager 57 - manages a communication session between money modules, 
and between a money module and- the Security Server 27. • - 

" Applicatibri Services are prd^id^d- by: ; ; . 

(3) Manage NetWork^' Sigri'r^ oh' 58 - Cdntrols the money module Network sign ^ on process;- 

(4) Synchronized Time/Date' 59 ^ keeps money module CIdck/Timer 43 services synchronized to a 
15 system time; 

(5) Route Message 60 - directory services for routing messages, controlling message routing during 
sign -on and during a money module session; and 

(6) Direct to Bank Services 61 - provides information on services provided by participating banks. 

As will be':ap'preciated by- one' skilled in the art, switching and processing centers- that are known in the 
20 industry may be used to enable the networking' codperation' between a fihanGiai' institution^ and ahy- other 
that is coupled to the same centers^ < : ; .. ^ 

Electronic notes 

25 We tul^n now to a further description of the elements o'^ the electronic notes 1 1 themselves.' 

An electrbniG? currency hote'-11 representing -value iis •essentially an electronic object created from a.f> 
transaction request (deposit or withdrawal) which is backed by demand deposits at an Issuing Bank 1. !At 
various times'-and' in various: points of. the system; the notes may appear ib eleetridal dr magnetic forrrts^or 
as electromaghetic radiation. ;These 'notes 11 may be "transferred over several transactions just like paper . 

30 mone:^. with the additiorfalnpropertyiof fungi btlity.tfiat allows the- electronic: notes 11 to be, comrnuted' and^ 
transferred in amounts- less tbiianin3Mquar to the val^^^^ . . 

Notes- 11 :nr)ay. be- split" by-appe^n'dfng- a trahsfer record the notei 11 and signihg the hote 'll-usihg the - 
private cryptographic key of the money module transferring the note 11. Electronic credit notes It/ 
however, can only be transferred once in the preferred embodiment, because it is ahticipateGf nhatt its-' = 

35 receiver must deposit the credit note 11 so that the loari' may be realized. : . i 

. ^Credit ndtes.lt. unlike currency notes 11 are drawn ori a sub'seribeY!s.r6an account. Eadh credit hote-^ll • 
carries the account number it is drawn on. The account may be a revolving* credit or credit line on which the 
note 11 is. drawn, operating much in the same way that a check or- a 'credit cai-d account works in today's- • 
banking industry. Credit notes It can represent a part of or all of thd credit line ^6f the account. 

40 In the preferred embodiment, the credit notes 11 can ortly be transferi-ed =to another-' Transaction money- 
module 4 by the ownier of the. aceounti and the receiver of a credit note It oan ohiy deposit it into his or 
her account as currency. From there, the credit note 11 is cleared with, the durrency at the Clearing Bank 3. 
Th!^. subscriber's bank recognizes the loan upon receipt of the cleared' credit note 11. 
• iWhen credit notes 11. are withdrawn, they do not trigger any accounting transactions in the preferred 

45 embodiment. Current credit line processing may to be modified to keep track of the amount of the credit 
line in the subscriber's Transaction rtibney module- 4. .Whenever/': t^ie' subscriber communicates with ^^the 
Issuing Bank 1 maintaining the credit'lirie. the amoUnt bf the: credit line in the Transaction mbney module 4 
is removed and replaced based on any adjustments to the credit line in the banking system. 20; Total' credit 
notes 11 plus- outstanding loans must be less than= or equar to the total amount of the credit line. • • 

50 Electronic notes 11 are comprised of three collections of data fields, namely a Body group, a Transfers- 
group, and a Signatures and:- Certificate group. Thei; Body ' group of data fields- includes the following 
information: 

(1) .the type, of electronic note 11, i.e:;: whether it is .a currency, note t1 or a credit note 11; <•''■■. 

(2) the Issuing Bank's t identifier; 

55 (3) the monetary unit identifier; . • 

(4) a Note identifier; : ■ - - 

(5) its date -of - issue; - , . . . * 

(6) its date - of - expiration; r. 
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(7) the subscriber's account number (used oniy for credit notes 11); 

(8) the amount or value of the note 11; and 

(9) the Money Generator module 6 identifier. 
The Transfer group of data fields includes: 

5 (1) a total of the number of times that the electronic note 11 was transferred; (provided for currency 
notes 11 only) 

(2) a list of transfer records that indicate to whom the apportioned note 11 was transferred from, the 
date - of - transfer, the amount transferred and the identification number of the receiver. 
The Signature and Certificates group of data fields includes: 
TO (1) the digital signature of the Money Generator module 6; 

(2) the Money Generator module 6 certificate: 

(3) a list of payers which contains each payor's signature and certificate: 

(4) the digital signature of the payor; and 

(5) the payor money module certificate. 

75 The notes 11, transfer records, the signature and the certificate of the chain of the transferred payments, 
constitute the electronic note 11 sent: the remaining amount of the note 11 is recorded in the Note Directory 
39 of the money module in which it is stored. 

It is important to note that the authenticity of an electronic note 11 is determined by the validity of the 
digital signature of the Money Generator module 6, and the validity of the signatures of past payors (if 
) 20 present). Any inconsistencies in this information will case the transfer of any electronic notes ;%'* tp be 
aborted. 

. It is also important to note that as a security measure, notes 11 will be valid- for a limited time, up to its . 
expiration date. An expired note 11 cannot be transferred, it must be updated by transacting- with a 
participating bank. To this end, whenever a Transaction money module 4 performs any transaction, with a. 

25 Teller money module 5. all of the electronic notes 11 stored in a Transaction money module . 4 will-be 
transferred to the Teller money module 5 so that notes 11 may be replaced with updated ones befoj;e they 
expire. This security procedure also helps .to keep offending notes 11 from being circulated broadly. 

As will be understood, every time that a note 11 is transferred to another money module, a digitally .^^.v... 
signed transfer record indicating from whom it is transferred is appended. Thus, the recipient, of an ... 

30 electronic note 11 will also receive a record of all of the past holders of the note 11. : 

For example, a S50 electronic note 11 may be generated, and withdrawn by. a Transaction. money - 
module 4. Assuming it is transferred to other money modules in $10, $10, and $30 denominations, the 
recipient money modules will receive the note 11 with the transfer record identifying the first Transaction 
money module 4. When a recipient of the $10 note. 11 transfers $5 of it to a third party^the-thirdrparty 

35 receives the note 11 along with the record indicating the previous two holders. Assuming this S5 note 11; is 
then deposited, a record of it will be matched with other segments of the original, $50 note 11 -that find there 
way back into the banking system by the clearing and reconciliation processes of the present embodiment. 
^ Only the receiver of the transferred note 11 can either deposit the note 11 or use it in payment. The 

J Verifier 42 application of a money module is used to check the signature of each transfer,, to determine if 

40 the note 11 is valid and to verify the identifier in the last transferor as the current holder of the note 11. This 
thwarts the new holder of a note 11 from trying to use a value greater than that which was transferred. It 
also inhibits copying notes 11 for use in another money module since the identifiers will not match. 

As can be appreciated, a subscriber may be able to access certain information about the electronic 
notes 11 stored within the Transaction money module 4, 

45 In particular, the subscriber may be able to select information on the total amount of the electronic 
notes 11 stored, the monetary unit of the notes 11, the type of electronic notes 11, i.e., currency or credit, 
and the denomination of each note 11. 

System Security 

50 

The security of the system is maintained by the participating banks and the Certification Agency 28, 
which creates and distributes money module certificates. A certificate of a money module is actually a the 
money module's identifier, its public key. a digital signature of a money module's identifier and public key 
certificatory key (described below), and the version of the certificatory key. The certificate is unique in that it 
55 is - associated with oniy one particular money module. 

The Certification Agency 28 provides a secure means for money modules to validate each other prior to 
transacting, first by controlling the money module certificate process and second, by distributing a list of 
bad money module identifiers. 
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In the preferree embodiment, the mbney module certificate will be Initially loaded into the money 
module by the Certification Agency 28. The Certification Agency 28 generates' th6 certificate for each 
money module using a certificatory key (a private key of the Certificate Agency 28). It may be- changed 
periodically and distributed under version control processes that are cdhnrhdnly used in the industry. As will 

5 be appreciated, every nfjoney mddule will- store sevei'al versions; of the certificatory key in drdeir/to verify 
certificates created by an older key. Because it is anticipated that certificates will expire over time, It is 
expected that brily a few versions need be- kept. ... 

A certificate will only be v^alid for a- limited period of time after its creation. Upon expiration of the 
certificate, the money module will not be allowed to ti^ansact with other ' moniey modules. Any money 

10 modules discovered to have been tampered with will be limited in the amdunt of damage that they cdh do 
to the system since their certificate will not be updated. 

To block offending modules from transacting it iS' also desirable to have legitimate money modules 
receive the latest list of offending money modules soon after the list is updated. Naturally,. this requires that 
Transaction money modules 4 access the Certification Agency 28 oh a periodic basis to obtain the latest 

15 list. Placing i time limit on the Transaction money module's 4 ability to transact (in addition to-the time limit 
placed on electronic notes i1) will -forcfe' subscribers to ^ access the Certification. Agency: 28'thrdu£|h the 
Network 25 on a periodic basis to receive the latest bad money module list along with the a new certificate.- 
Advantageously; -Vrte period of the certificate' validity can be closely nionitored arid adjusted according: to 
security needs. - . . 

20 The Certification Agency 28 dis'tribufes its Up'dated cdrtificatd'ry'k'ey and money module certificated .on - 
line through the Security Server 27 (see Figure 9). An important component of the system's security" is =. 
provided by ' Sdcurity Servers 27 ait-thevpairtiGipating banks dnd Security Servers 27 at the Certification 
Agency 28;' ; : . . . - 

Pteferrihig n'ow.'tb' Figure^lO; a block-diagram of a preferred embodiment :of the -Security Server .27 15/: 

25 shown. It is contemplated that the Security Server 27 at the Certification Agency 2ff or 6n a bank's local ^ 
network 18 will contain' the following application, functions: 

(1) Exterhar ihtertate 54 - a cdmmuriic^^^ lay^r for connecting to a bank's local network 18 or the 
GeHification^ A^encyvS-' local netvvork 17j ■ ; . 

(2) Session Manager 55 controls the security aspects of a. transac 

30 (3) Create Certificate 50 '-^ certifiesi a certificate for any. of- the imbney modules;-' ■ 

(4> Create Account^ Rrbfilev^Sil^ ' certifies and ::stgns a^vb^rik account ^p^6file.. (described, in detail 
hereinafter)-* that- ialfdWs ^a'^ Traiiiisaelibh moniey . module 4 to - ^access thfe: 'subscriber's differerit bank ^ 
accounts:- . . = ^. 

(5) Distribute Certification. Keys 52i' - distributes thb' Certification AgenCy^s-. 28 list of valid" public keys te- 
as the; money rhodules; . ;. ■ • : 

(5) Bad Money Module Control 53 ^: controls and distributes the list of badimoney'modules;:and - 
(7) Services identical fb the cryptographic functions: 44. 45. 46 in the money modules described above 
Since certificates will expire over tinhe, money modules IWill be Required to apply for new: certificates 
periodically: In order to receive a new certificate, the money module creates- a new public key and:private ' 
40 key/ Th^ new; public key; the money, module identifier .Snd -the old certificate eire presented) to; the- 
Ceilification Agency- 28 after being digitally' signed- using the-ojd private ke^^ 

The Certifieatidn Agency 28 checks the signature , and if it. is valid; signs, the new public key and 
identifier and s'ends the certificate toithe money module with a. future expiration. 'date. The Certification 
Agency's 28 Security Server 27 also distributes a list of bad money modules via- the? ? Network 25; ^nitially, 
45 eaeh^ participating bank's Security Server 27; reports the identifiers -of fnoney mbduJ^s which hold notes .11 
invalidly or that are counterfeit. Those identifiers are pass'^ed through the Security Servers 27 and are 
compiled by the Certification Agency 28. ; 

All such identifiers are distributed to the Teller and Money Generator modules 5, 6 respectively. A 
money module will not transact with another money module found on the list of bad money nniodules. 
50 Optionally, only those money modules which have demonstrated a flagrant breach of security will be 
distributed to Transaction money modules. 4.' . . : i r • 

If a Transaction money module 4 is lost or stolen, the. subscriber would report it.td his/her bank.or to the 
Certification Agency '28 so that the money module i identifier may bO' placed, on the: bad -money, module list • 
to inhibit any. further transactions. 
55 While the security of the system is provided by being able to block a money module from, transacting, 
system security is also maintained by providing the expiration date on the electronic notes I t in addition to 
the money tmodule certificates. 
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As mentioned previously, a note 11 wild be valid only for a limited time period after it is generated. Its 
date - of - expiration is a security parameter which may also be monitored and varied as needed. The 
period of validity of a note 11 can be varied by the value of the note 11. Preferably, a large note 11 will 
expire in a shorter time period than a smaller one. For example, a Si ,000.000 note may be set to expire five 

5 days after the date of its creation since it would provide a significant incentive to counterfeit, while a S50 
note 11 may be set to expire after a month from the date of its creation. 

A Transaction money module 4 will not accept expired notes 11. but can deposit or exchange the notes 
11 it may contain for new notes 11. The expiration dates are checked, by the Verifier 42 and Clock/Tinrier 43. 
applications in a money module before any electronic note 11 is transferred. Separately, it is also 

TO anticipated that if the money module loses power then it will not be able to pay or exchange notes 11 after 
power has been regained until it has communicated again with the Network 25 and had its security 
parameters updated. 

As stated above, a subscriber will typically obtain a Transaction money module 4 already loaded with a 
certificate. Securing the Transaction money module 4 itself to a subscriber may be accomplished by 
15 assigning it a unique PIN. biometrics or other personal secret characteristics. 

Before any personalization of the money module 4 may proceed, the Transaction money module 4. 
checks if there is a bank account already stored in the To Teller 34 application or if the Notes 40 application 
contains any electronic notes 11. In either of these cases, the Transaction money module 4 will inhibit the 
• subscriber from securing the module with new secret information. 
C ) 20 If the Transaction money module 4 has no account numbers or no stored notes 11. then the subscriber 
can secure it by either entering a PIN, which is reverified by the Transaction money module ..4^, or; by 
1 executing, a. process in which the Transaction money module.4 learns the subscriber's biometrics.-Qi^%tl?e 
personalization has been completed, subscriber access to the Transaction money module 4 requires the 
successful completion of a sign -on in which the secret information is presented to the Transaction.jnoRey^-- 
25 module 4. If the subscriber can sign on to the Transaction money module 4, then he/she will be permitted' 
to change PlN's or reintroduce biometrics. 

In the situation where a subscriber has forgotten his/her PIN or had an incident which has affected 
his/her biometric reading, then the subscriber may take his/her Transaction money module 4- to a 
participating bank. A special transaction may be executed which deposits any electronic notes 14 in a 
30 holding account and destroys the stored bank account numbers. The subscriber can now enter nevy secret 
sign -on numbers and characteristics. Any electronic notes 11 that were removed are returned.; to the 
Transaction money module 4 and the bank account numbers may then be recreated (sea Bank r 
Access below). 

It should be noted that it is not a requirement for a subscriber to identify himself to the system. when he 
35 takes possession of a Transaction money module 4. Though the identity of the money module is contained 
in every transaction, the holder of a Transaction money module 4 can be.kept. sjecret. If the; relationship is 
revealed then one could trace all of the transactions of a subscriber for the period that the^relationship can 
be corroborated. The only time a subscriber must reveal his identity is if he/she links the nipney module to 
) . a bank account or wishes to redeem money lost. 

40 tf the subscriber chooses to use the Transaction money module 4 only for payments and foreign 
exchange then he/she can keep the relationship secret. As may be appreciated, the subscriber may alsa 
acquire a plurality of Transaction money modules 4 and, for example, link one to bank accounts and 
maintain the others for anonymous payments. The other Transaction money modules 4 may be loaded with 
notes 11 by exchanges with other money modules or by exchanging for cash notes 11. 



45 



Replacement of Money Module Value 



If a Transaction money module 4 malfunctions or is lost or stolen, it may be possible for the subscriber 
to recoup the value that was stored in the money module at the time of the incident. This would necessitate 

50 that the subscriber relinquish the option of anonymity for that money module, since upon making a claim for 
the lost money, he/she would have to verify that he/she is the owner of the Transaction money module 4. 

To provide for the replacement of electronic notes 11, the subscriber may first link his/her Transaction 
money module 4 to a bank account or register ownership of the Transaction money module 4 with the 
Certification Agency 28. After every transaction involving the transfer of electronic notes 11. the subscriber 

55 could save the Tran Log, which identifies the counterparty money module identifier and the note identifier, 
to inexpensive, non- volatile storage which is removable from the host computing environment. This log 
may be presented by the subscriber when making a claim to replace value. The log may then be compared, 
to reconciliation files to determine the true value of the lost electronic money. 
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Ari alternative to this procedur'e would be to refresh the money iH the TrahsaictiGh money module 4 
frequently. This would rtieari that the notes It in the Transaction mbh6y nnodule 4 would be represented by 
transaction recoi'ds at the Issuing Banks 1. The existence of the notes 11 could verified by scanning 
these files. r . ■ . 

5 A third alternati<^e would allow the system to - captui'e a money nibdufe'^ Trari- Log* wheh money is 
refreshed. These records would be copied- and routed to Issuing' Banks t for stbraige oh their transaction 
histories, the Existence' of th(e*=notes 11 doiijld then b'ef verified as in th^ previous alternative. 

Bank Access 

TO ' • ■ ' ' ■ '> • ' ' " '■ • / - 

Accbrdihg to one asf)ect of the invehtibh, a • cus'tbhaer's TransactiiDn mbhey module 4 riiay access 
his/her accounts for deposits, withdrawals, transfers, etc.. at any bank participating in the system' ahd iri 
particular any bank hbTdihg ah aecbuht with the subscriber. For iiistarice. a typical subscribbH rhay havea 
savihgs account and a checking account at one of the participating banks, while maihtainiirig a so -" called 

75 money market account at a separate financial ihstitutibn, and perhaps a credit - lin^ aciGOuht- ait' a third 
participating bank.' It is ahticipi^ted that a subscriber's TranisaG'tioh mciney module' 4 wiir-aci^ess his/her 
accbuhts fbr deposits, withdrawals^ loan payments^ and inquiries at any- b^nk or finaMial instifutidh' Which 
can be' acbe'ssfe'd thr*bugh' the . . . .; s;=r 

If a subscriber has multiple accounts, the subscriber's account relatioriships with, a bank will be stored 

20 in an acicbunt profile in ■ the TO ■ Telibi' 34 appjicatibn of the Transaction money rhbdule 4. The* muitiF)le 
accounts can be linked together by the personal account nurtiber ("PAN") associated with the iridividual • 
subSieriber. . • ' . . . . . 

Thb account profile may be created either in person, under the coritrbl of a beirik subschbbi'' service 
reprigsbnta'tive at a- branch, orb'ver thb telephone utilizing a special' dialogue.- Fbr ex'amjpleV the subscriber 

25 may identify himself by his PAN- and PIN: He may then ehtbr each- account number he wishes to access 
from his Transaction money module 4. The account numbers rnay be verified' in- the bank's- account 
reference files: A cross-reference of accounts' to Transaction mbriey mdduieis 4 rhay bb maintained by 
each bank if they so choose. > 
^ The Gompositib'fV of ah exerripiai^ account pi'ofile m 

30 (1) Bank Identifier - - bhe for each barik; ' • 

(2) Account Numbers;- ' ' . 

(3) Accburit Typiss-- ^ e:g.,^checkihg^^ - ■ ^nr 4 . = . 

(4) Security Server's 27 signature on the list of accounts. .{v, . : . 

It will bb uridbrstbod that the list of account numbers will be digitally signed by the bank Seeul-ity Server 
35 27: As a further security measure the aecbunt profile may- be re - signed with ari updated p'ublic key on a 
periodic basis. The fundamental; access security is provided by the' digital^igriatu're of 'thb bank's SetOrity ■ 
Server 27. 

Banking System (Accounting Architecture) ' 

40 ' ' ^' ■ ~~~7 

It is an notable feature of thb prbfbrred elm bbdim'ent, that thb nfibthoGf 'of the S'ystbrti can paraHbl 'the 
existing and varying type's of accounting methods that exist today: The system of the prbferred embodimbht • 
follows the various types of accbunting methods practiced 'presbritly in various banks. Hbwe\?br, it^ is ' 
important to note that unlike the preset ; banking system, Irr th^e"*- preferred embodiment of thb iriveritibn; 

45 economic value is created on demand. Thus, there is no inventory of cash or checks involved: electronic 
currency from demand deposits an electronic credit are created on a realtime bWsis. This elirhiriatiori of a • 
paper inventory by using an electronic media of exchange requires certain supplements to the commonly 
practiced accounting techniques to provide the real-time accounting hbeded. - • 

Accordingly; the enSbodinrient of the pres'eht* thverition provides ah accounting structure to sypiplerhe'nt • ^ 

50 those used in the present banking systems 20: The improved accounting arrahgembrit may bb utilized to ' 
monito'r the electronic money and each bank's obligation when a fihahciai tfansacfibn between a Transabtibnt • ' 
money module 4 and a Teller money module 5 occurs^ or when a Clearing Bank 3 perfdrms any clearing 
processes: ' • • - . - 

When electronic notes 11 arb transferred to or from a Teller money module 5, in' most cases accouriting 

55 transactions a'ffectirig ■ the records of the banking system 20 are created; Conversely^ transfers between 
Transaction money -modules 4 do not involvb any forhnar accounting procedures - they involve only the • 
transfer of electi'orfid' notes .11. 
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In the system being described, it is anticipated that the following arrangements of accounts are to be 
utilized for each type of bank, categorized under each monetary unit: 
At an Issuing Bank 1 - 

(1) Money Issued Account: A liability account which reflects the money issued but not cleared. 

(2) Money Due Account: An asset account reflecting the money deposited to the bank's accounts. 

(3) Deposited at Clearing Bank Account: An asset account reflecting the balance of a clearing account at 
a Clearing Bank 3. 

(4) Correspondent Bank Money Account: A liability account owned by a Correspondent Bank 2 which is 
drawn upon by the Correspondent Bank 2 to dispense electronic money, 

(5) Money In Transit Account: A zero -balance liability account owned by each bank, which is used to 
temporarily maintain electronic money during a financial transaction. 

(6) Foreign Exchange Account: A zero - balance liability account owned by each bank, which is used to 
handle multiple currency exchanges. 

At a Correspondent Bank 2 - 

(1) Deposited at Issuing Bank Account: An asset account reflecting the balance :of the Correspondent 
Bank 2 account at the Issuing Bank 1. 

(2) Money Due Account: An asset account reflecting the money deposited to the bank's accounts. 

(3) Foreign Exchange Account: A zero -balance liability account owned by each bank, which is used to 
handle multiple currency exchanges. .. 

(4) Money In Transit Account: A zero -balance liability account owned by each bank, which is^used to 
temporarily maintain electronic money during a financial transaction. 

At the Clearing Bank 3: - 

(1) Issuing Bank Clearing Account: A liability account to net the amount of money cleared for an Issuing^ 
Bank 1. ....... ^^.J 

The accounts, with their corresponding symbols, are summarized below: • 



30 



35 



AO 



Type of Bank 


Account Name 


Type 


Owner 


Symbol 


Issuing 


Money Issue 


Liability 


Issuing 


Ml 




Money Due 


Asset 


Issuing 


MD 




Deposited at Clearing Bank 


Asset 


Issuing 


DC 




Correspondent Bank Money 


Liability 


Correspondent 


CM 




Money in Transit 


Liability 


Issuing 


IT 




Foreign Exchange 


Liability 


Issuing 


FX .. . 


Correspondent 


Deposited at Issuing Bank 


Asset 


Correspondent 


iDI' 




Money Due 


Asset 


Correspondent 


■MD:> 




Money In Transit 


Liability 


Correspondent 


IT 




Foreign Exchange 


Liability 


Correspondent 


FX 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 
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Transaction processing, for a transaction such as a request for a withdrawal from savings, selects 
accounting processes so that the appropriate accounts may be credited and debited accordingly. It is 
anticipated that the accounting processes will be using software programs and methods that are well known 
in the art and presently available; inasmuch as any of the programs and methods currently practiced and 
known for providing the foregoing accounting procedures would be suitable for use in the- invention. To 
better understand the accounting processes of the invention, several examples of typical transactions and 
their associated accounting steps will be described. 

Accordingly, Figures 11-24 illustrate the accounting transactions for deposits, withdrawals, foreign 
exchanges, receipt of cleared money, electronic money/cash exchanges, and note 11 updates. Figures 11 - 
14 and 19-22 also illustrate the accounting flows when a Transaction money module 4 contains notes 11 
that are not involved in the particular transaction that is occurring. The notes 11 that are not part of the 
transaction are replaced with updated notes as discussed in the security procedures described above. For 
example, when a subscriber deposits less electronic money than is stored in his/her Transaction Money 
Module 4, leaving a balance, the electronic notes 11 representing the balance are then replaced with 
electronic notes 11 containing the most up-to-date certificates. This latter case is indicated in the 
parenthetical on Figures 20 - 23 and 28 - 31 , 
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In ah example of the accounting arrangenrients acGording to the invention (iHustrated by Figure 11)". if a 
subscriber were to deposit $50.00 out of S100;00 of electronic money contained in his/her Transaction 
money modules 4 at a Correspondent Bank's Teller money module 5 (Step 1). the entire $100 of electirdiiic 
money would be extracted of which $50.00= would first be credited to his7h^r custdnrier account (tierein 
5 denoted by -"A"), the remaining $50.00 would be credited to the Gdrrdspohdeht Bank's In -Trarisit aiccduht. 
and $100 would be debited to the Money Due^account at the Gorresponderit Bank 2. See "IT" ahd "MD" in 
Figure 11. 

After the $100 of electronic notes 11- is^ renhoved, the notes 11 are depositeid frohi the Correspohdfeint 
Teller money module 5 to the Teller money modufe 5 of an' Issuing- Bank 1 (Step *2); In accGrhpiishing this 

w transfer, the Money Due- account at the Gorresponderit Bank 2 is credited $100''=while its Deposited at 
Issuing Bank account is debited by $1 00; the Issuing Bank 1 credits Its Correspondent Bank Money acGidunt 
by $100 and debits its Money. Due account by $100. • > 

In Step 3, the updated notes 11 are requested. Thus, the Correspondent Bank 2 requests 'frorri the 
Issuing Bank 1 the withdrawal of $50 of electronic money containing the most recent- certificates from its 

75 Money Generator module 6v Td support this request. $50 is credited to the Deposited at issuing • Bank 
account and $50 is debited from Its Money In Transit account. The Issuing Bank 1 then debits $50 from it^ 
Correspondent Bank-Mbney aCedunt and ci'edits $50 to its Money Issued account ; . , 

T6' complete the transaction; the.$50 is then transferred frorh the Money Gerierator module 6 td the 
Correspondent Bank's 2 Teller money module 5 through the Issuing Bank's 1 Teller money module 5, and 

20 finally to the Transaction money module' 4- (Steps 4-6). The net result of all of these transactions is that 
$50 remains deposited in the subscriber's account and $50 of newly issued electronic notes 11 are how 
stored in the Transaction money module 4 of the subscriber. ■ • > ■ .-t 

Alternatively, if a subscriber begins with $50 in his/her Transaction money nriodule -4 and deposits all of 
it. the customer account would be credited $50 and the Money Due account would be debited by $5D (Step 

25 1 of Figure 1 1 ; parenthetical entries). 

When there are only $50 of electronic notes 11 that are removed, the Correspondent Bank 2 credits the 
Money Du$ account" ^50 " and the Oep^ at Issuing Bank account js debited $50 (Step:2, parepthetical 
entries). This money is then deposited at the Issuing Bank 1 for later clearing, wherein the Correspondent 
Bank Money account- is credited by. $50 and, the Money Due account. is debited by $50: Because no 

30 updated electronic notes 11 need- be. returned in* this situation, the deposit andits* corresponding accounting 
is completed at ^St'ep 2> ' : : 

The abcountihg processes of ah electi'onic money"' deposit- 'at - an ■ Issuing. Bank 1 instead ( of a 
Correspondent Bank involve fewer, op'eratiorial steps, which are illustrated- in Figure 12. Using the isame 
dollar amounts as in the previous exehnplary- trans ai^tion. when $50: of $100 in electronic money stored in 

35 the Transaction money module 4 are deposited directly to art Isisuirig Teller mphey module (Step 1), $50 
would be credited to the customers account (A). Fifty dollars would simultaneously be ci'edited tb the 
Money In Transit account, and $100 would be debited to the Money Due account at the Issuing Bank 1. 

Since the entire $1 00 stored in the Transaction money module .4 is rerhoved and transferred to the 
Issuing Bank's Teller money module 5. it is nepessary to return $SU'Qi updated notes to the Transaction 

40 money module 4. Accordingly, as shoWn in. Step 2 the Teller money, module 5 requests $50 ^rom its' Money 
Generator module 6, debiting its Money In Transit account by $50'and crediting its Moriey Issued acfcount 
by $50. 

In response, $50 is created by the Money Generator moduli' 6 and' transferred to the feller money 
modute 5, which in turn transfei's this electronic money to the Transaction money module 4 (Step 3-^4)^ 
45 When only $50 is stored in the transaction nribney module' 4 and all of it is. deposited, the customer's 
account (A) fs credited $50'. the Money Due account is credited $50/ and that' is tfie end of it. 3ee 
parehthetliial entries in Step ^ in Rgure 12^ ...... 

In the cas^ of a withdrawal from a Correspondent Bank (see Figure 1 3), a withdrawal request of $1 00 by 
a subscriber using a Transaction money module 4 at, a Correspondent Bank 2 will cause the subscriber's 
50 account (A) to be debited by $iOO and the Cprrespbndent Bank's 2 Money In Transit account to be credited 
by $100 (Step 1). the request foi-' the $100 withdrawal is forwarded to the issuing Bank' 1 fr9m the 
Correspondent Bank 2, and. ^the Correspondent Bank's Deposited at issuing Bank iaccount.iis credited by 
$100 while its Money In transit account is debited by $1db (^tep 3). ' . * ' 

Next, the' request for $'i 00 is. forwarded by th^ Issuing Bank's t teller money module' 5 to the Money' 
55 Generator module 6.' Accordingly., the Correspohdehf Bank Mbiiey account gets a $105 d'ebtl while the 
Money Issued account gets a "Si Op criBdit'^ 

The Money Generator mbdufe 6 then creates the $100 of electronip notes 11. . and transfers it. to the 
Transaction money module 4 via the Issuing Bank's 1 Teller money module 5 and thie borrespidhderit 
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Bank's 2 Teller money module 5 (Steps 5-6). 

When, e.g.. the subscriber makes the $100 withdrawal request with a Transaction Money Module 4 that 
contains $50 of electronic notes 11, the notes 11 are removed and now the Money Due account is debited 
$50, the subscriber's account is still debited $100, and the Money In Transit account is credited $150 
5 (parenthetical entries. Step 1). 

The 850 is then deposited to an Issuing Bank 1, causing the Money Due account to be credited $50 
and the Deposited at issuing Bank account to be debited by $50. At the Issuing Bank 1, the Correspondent 
Bank Money account is credited $50 while the Money Due account is debited $50. (Step 2. parenthetical 
entries). 

70 Because $50 of notes 11 have been removed, the withdrawal request in Step 3 must be for $150. This 

request causes the Deposited at Issuing Bank account to be credited by $150 and the Money In Transit 

account to be debited by $1 50 (Step 3 parenthetical entries). 

At the Issuing Bank. $150 is requested from the Money Generator Module 6 and the Correspondent 

Bank Money account gets a $150 debit while the Money Issued account gets a $150 credit (Step 4 
75 parenthetical entries). As above, the money generated by the Money Generator Module 6 ($150) gets 

conveyed to the Transaction money module 4 via the Issuing Bank 1 and Correspondent Bank 2 Teller 

money rnodules 5 (Steps 5-6, parenthetical entries). 

A withdrawal from an Issuing Bank 1 Involves fewer accounting procedures. Referring now to Figure 1 4, 

a withdrawal request by a Transaction money module 4 from an Issuing Bank 1, Step 1 will cause the 
20 Issuing Bank 1 Teller money module 5 to debit the subscriber's account (A) by $100 and credit its^^Money 

Issuing account by $100 (Step 1 -2). 

. A request for an updated $100 is then made by the Issuing Bank's 1 Teller nnpney module.5^.to.^the = 
Money Generator module 6, which upon its creation will return $100 to the Issuing Bank's Teller money 
module 5 (Step 3). In completing the transaction, the Issuing Bank's 1 Teller money modular„5\f.sinE3Bl^v. 

25 transfers this Si 00 containing the most recent certificate to the Transaction money module 4 (Step 4).. 

Alternatively, when the Transaction money module contains $50 at the time of the $100 withdrawal, 
(parenthetical entries) the $50 will be removed, the Issuing Bank's Money In Transit account will be credited 
$50 and the Money Due account will be debited $50 (Step 1). 

The Issuing Bank 1 must now request $150 from the Money Generator module 6. NaturaJ.ly, the 

30 customer's account is debited $100. The Money Issued account is credited by $150 when the new notes 11 : 
are created, and the Money In Transit account is debited $50 (Step. 2). From there, $150 is returned:. to the 
Transaction money module 4 via the Issuing Bank's 1 Teller money module 5 (Steps 3-4). 

Figure 15 illustrates the case of a foreign exchange with an Issuing Bank 1, In . this.. example, a. 
subscriber wishes to exchange $100 of electronic money stored in his/her Transaction rnoneiy ..module. 4:, for 

35 £60 of British currency. The deposit at the Issuing Bank's 1 Teller money module 5 will cause the Issuing 
Bank's 1 Foreign Exchange account to be credited by £60. while its Money Dua.account: would be debited 
by $100 (Step 1). Here, the $100 is transferred from the Transaction money module 4 to the, Teller money 
module 5, which then requests that an electronic note 11 representing £60 be created,: by the Money 
Generator module 6 (Step 2). 

40 At the Issuing Bank 1. the foreign exchange account is now debited by £60 while the Money Issued 
account is credited by £60. The £60 electronic note 11 created by the Money Generator module 6 is. 
transferred to the Teller money module 5, which now stores both the $100 and the £60 (Step 3). The £60 is 
then transferred from the Teller money module 5 to the Transaction money module 4 resulting in a net 
balance of £60 in the Transaction money module 4 and $100 remaining in the Teller money module 5, 

45 completing the transfer (Step 4). 

The accounting procedures for a foreign exchange of $100 for £60 at a Correspondent Bank 2 are 
shown in Fig. 16. The Transaction money module 4, in this example, requests that its $100 be used to 
"purchase" £60 from the Correspondent Bank's Teller money module 5, which causes the Correspondent 
Bank's Foreign Exchange account to be credited by £60 while its Money Due account is debited by $100 

50 (Step 1). The $100 stored in the Transaction money module 4 is transferred to the Correspondent Bank's 2 
Teller money module 5, which sends a request to the Issuing Bank's 1 Teller money module 5 to withdraw 
£60, . and debits its Foreign Exchange account by £60 and credits its Deposited at Issuing Bank account by 
£60 (Step 2). 

The corresponding account transaction at the Issuing Bank 1 debits the Correspondent Bank Money 
55 account by £60 and credits the Money Issued account by £60 (Step 3). The Issuing Bank's Teller money 
module 5 then requests that the Money Generator module 6 create £60 and transfer it to the Issuing Bank's 
Teller money module 5. which in turn transfers it to the Correspondent Bank's 2 Teller money module 5 - 
(Steps 4-5). From there, the £60 note 11 is transferred to the Transaction money module 4. leaving it with 
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a balance of £60 while the Correspondent Bank's 2 Teller money module 5 finishes? with a balance of $100 
(Step 6): •. ■- , ^ . 

The ; accounting- tpahsactioris fdf a withdrawal or deposit of creidit ^riotfes 11 also involve several 
• accbuntirig dpemionsi 'as' shown in Figure 17. WHeh a subscriber wishes to withdraw- money frGrYi his/her 
5 credit line (Step 1). the proper credit note 11 is simply transferred from the Money Generaitor moduIe'S'to ■ 
the Transaction money m'ddule 4; reducing the: customer's credit line by ah dqusil arhbunt to th^ 'amount 
trahsfen^ed (Steps 2-4).: ^^i^c . • ..i: ■ . . . ■■ . . :. , ,\ . , , ; 

: Alternatively, when cr'edit not^s'^H are deposited by a 'Subscriber's trarisac'tidn money module 4V th^ 
subscriber's account is increased by the amount deposited, and the Money Due account is debited by -an- 
70 equal' annbUnt (Step'' 1). • ; • • : r . ■ 

The accounting' operations involving the Issuing Bank's 1 receipt of cleai-ed eletitironic money' will ribw 
be described. Referring to Figure 18. in this example $100 of electronic mdney a£nd '$ld(j of credit ndtes' 11 
have been cleared by the Cleiaring Bank 3 to settle tKe balances dmorig^' several lissuinicj Banks^ The $100 
of electronic money and the $100 of credit notes "are transferred tb- the proper Issuing Bank 1(St'^p 1). 
75 Additionstlly, $50 of electronic notes 11 that It .has issued are -alsa deposited -at - the Issuing Bank 1. 
Consequently* the Issuing Bank 1 Will^ ddbif the subscrifeier's' accouht A by $100;*debit the Issuing Bank's 
Money Issued account by $150, credit the Money Due Account by- $50; and credit the Issufhg BanVs 
Deposited at Clearing Bank account by $20046 complete the transaction; ...=': , , , - ; / v. . ~ 

Turning now to Fig. 19, an accouriting-example of an exchange of cash for electronic notes 11 at'-an 
20 Issuing -Barik 1 is shown. In this e)<ampie, the- subscriber wishes to exchange $50 of casK' for $50 df- 
electronic notes 11 to add to the $100 of electronic notes 11 already stored in* his/her Transaction man'ey 
..module 4.^' ■ . " . . • '. - " : : ' . ' • ' ' ' " 

In the first transaction* the $50 of cash is deposited at the Issuing BankM which causes the Money In 
Transit account to be credited: by $50, while the cash acbbuntiis^ debited ■ • ^ 

25 Next, the $100 of electronic notes 11 in the Ti'arisactidri money module 4 is.removed, resulting in the" 
Money In Transit -account being, credited by $100i whil^ the Money Due' account is' debited by $100 (Step 

2). ■'. :■■ - ■■ - /■ ' ■■■ . .. 

The Teller money module 5 will now request:$l50 of 'Ble'etroniC' note's- 11 .frdnn the 
module 6 to return- $150. of 'electronic notes li- to the subscribei- (Step'3). Aocotdinglyt the Money In Transit 

30 account is debited" by $150 "while the Money Issued account is \Gredit'ed - ' 

The newly generated $150 of electrbhic notes 11 is the'n transferred - from th'e^ Money: Generator module 
6 to the Teller money module 5;- who in turn- transfers Uhe> $150 to the subscriber's Transacti 
module 4 (Step 4-5). The completed transaction leaves the subscriber with $150 of eiectronid notes 11 arid 
the Issuing Bank's Cash account cdntaihing a $50 balance, 

35 A^so :shown parenthetically in Fig. 19 is the case when th6 subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero i balance in his/her Transaction money module 4i In Step 1, the $50- 
of cash is deposited at the Issuing Bank 1 wiiich causes the Money In Transit :aeGrbunt to be credited by 
$50, while the cash account is debited by $50. Since ho notes 11 are rerhoved, no accounting is perfornried 
in Step 2. ' . . : , 

40 In Step 3, only $50 is requested from the Money Generator module 6." and- the Money In Transit 
account is debited by $50 while the Money Issued account is credited by $50.;The~samfe transfer between 
money modules ocduir^ as in Steps 4-5 of Fig. 1 9 described, above, using' only the $50 -that was recjuested.:. 
This would leave the subscriber with $50 of electronic notes 11 in lieu of his original $50 of p^per .money. 
In Fig. 20. an exchange of cash for electfonic notes 11 at a Correspondent Bank 2 is shown. This 

45 example uses the same parameters as in Rgure 19. namely, the subscriber has ;$50 of feash and ^$100 of 
electronic-notes 11 in his Transaction money module 4i. ' -■ . : : . v . . ; . 

When, the $50 in' cash is deposited to the CiDrrespondent Bank 2; itS' jMoneyi In. Transit aeeount is- 
credited $50 while its Cash account is debited $50 (Step 1). The $100 of electronic notes 1.1 is then 
transferred from the Triansactton nhoney rrioduie 4 to. the Correspondent Biahk 2 which^Gredits its Money fn 

50 Transit account by $100 and debits its Money Dije account by $100 (Step.2): 

Frbnn. there, the StOO, of electrdnic not^s 11 is.depbsited at the Issuing Bank 1, wherein; its. Money Due 
account is debited by $100 while its Cdrrespdhdent Barik Money account is credited by $1G0 (Step 3), At 
the Correspondent Bank 2, the Deposited at Issuing Bank account is debited by $100 while the Money -Due = 
account iis credited by $1 00. r 

55 vA withdrawal request is then made by. the Correspondent Bank 2for $T50 from the Issuing Bank.i; (Step- 
4). This; i-equest results :in the .Correspondent Barik 2 debiting its Money In Transit= account by $150' arid 
crediting; its Deposited at lssuihg Bank account by, $150. 
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Correspondingly, the Issuing Bank 1 Teller money module 5 requests $150 of notes 11 from the Money 
Generator Module 5. debits its Correspondent Bank Money account by $150 and credits its Money Issued 
account by $150 (Step 5). 

Finally, the $150 of electronic notes 11 is transferred from the Money Generator module 6 to the Issuing 
5 Bank's 1 Teller money module 5 which transfers it to the Transaction money module 4 after passing 
through the Correspondent Bank's 2 Teller money module 5 (Steps 6-8). 

Alternatively, a subscriber having only $50 of cash and no notes 11 in his/her Transaction money, 
module 4 is also shown in Fig. 20. As in the first case, the $50 in cash is deposited to the Correspondent 
Bank 2, its Money In Transit account is credited $50 while its Cash account is debited $50 (Step 1). 
10 A $50 withdrawal request is then made to the Issuing Bank 1. and the Money In Transit account is 
debited by $50 while the Deposited at Issuing Bank account is credited S50 (Step 4, parenthetical entry). 
Thereafter. $50 is requested from the Money Generator Module 6. the Correspondent Bank Money account 
is debited $50 and the money issued account is credited S50 in Step 5 (parenthetical entry). Here. $50 in 
electronic notes 11 are transferred through the same money module path as Steps 6-8 above, to reach the 
15 Transaction money module 4. 

Figure 21 illustrates the exchange of electronic notes 11 for cash at an Issuing Bank 1. Here the 
subscriber has SI 00 of electronic notes 11 stored in his/her Transaction money module 4 and wishes to 
exchange $50 of the electronic notes 11 for $50 of paper cash. 
-A After the Transaction money module 4 establishes the communications with the Issuing Bank's f Teller 

J .20 money module 5. all $100 of the electronic notes 11 is removed from the Transaction money moduie '4 - 
(Step 1). This causes the Money In Transit account to be credited by $100 and the Money Due account (at 
the Issuing Bank 1) to be debited by 81 00. - _ , 

The Teller money module 5 then requests $50 of updated electronic notes 11 from the Money" 
Generator module 6, and this transaction requires the Money In Transit account to be debited by .$50'and. 
25 the Money Issued account to be credited by $50 (Step 2). The newly generated $50 of electronic notes 11 
is then transferred to the Transaction money module 4 through the Teller money module 5. The $50 of 
paper cash is then transferred to the subscriber through a Teller or ATM (Steps 3 - 5). 

Also shown in this figure (parenthetically) is the subscriber making the same exchange for cash'when 
only $50 is stored in his/her Transaction Money Module 4. At the Issuing Bank. $50 of electronic notes 11 is 
30 removed for which the Money In Transit account is credited $50 and the Money Due account is debited 
$50. Fifty dollars of paper cash is then returned to the subscriber since he/she only deposited $150 of ^ 
electronic notes 11 (Step 5). . 

Completing this transaction, in both cases the Money In Transit account is debited by $50 while the 
cash account at the Issuing Bank 1 is credited by $50. The net result is that the subscriber ends up with 
35 $50 Of paper cash and. in the former case only, $50 of updated electronic notes 11 in his/her Transaction 
money module 4. ■ 

The exchange of electronic notes 11 for paper cash at a Correspondent Bank 2 is illustrated in Figure" 
22- As in the example illustrated in Hgure 21, although the subscriber is only exchanging $50 of electronic 
notes 11. all $100 of electronic notes 11 are transferred from the subscriber's Transaction money module 4 
40 (Step 1). 

•After the notes 11 are transferred, the Correspondent Bank's 2 Teller money module 5 credits its 
Money In Transit account by $100 .and debits its Money Due account by $100. This Si 00 of electronic 
notes 11 is now deposited at an Issuing Bank 1, causing the Correspondent Bank 2 to credit its Money Due 
account by $100 while debiting its Deposited at Issuing Bank account by $100 (Step 2), 

45 At the Issuing Bank 1. Si 00 is credited to the Correspondent Bank Money account while $100 is 
debited to the Money Due account The Correspondent Bank 2 now makes a request to withdraw $50 of 
electronic notes 11 from the Issuing Bank 1 (Step 3). Consequently, the Deposited at Issuing Bank account 
is credited by $50 while the Money In Transit account at the Correspondent Bank 2 is debited by $50. 

Now, the Issuing Bank's 1 Teller money module 5 request S50 from the Money Generator module 6 and 

50 debits its Correspondent Bank Money account by $50 while crediting its Money Issued accpunt by $50 
(Step 4). The S50 of updated electronic notes 11 is transferred from the Money Generator module 6 through 
Issuing Bank 1 Teller money module 5 and the Correspondent Bank 2 Teller money module 5. back to the 
Transaction money module 4 in Steps 5-7. 

Also illustrated is this same example with only $50 stored in the Transaction money module 4, which is 

55 deposited at a Correspondent Bank 2. to be exchanged for paper money. For this deposit, the Money In 
Transit account is credited $50. and the Money Due account is debited $50 (Step 1). The $50 is then 
deposited by the Correspondent Bank 2 to its account at the Issuing Bank 1, At the Correspondent Bank 2, 
the Money Due account receives a $50 credit, while the Deposited at Issuing Bank account receives a S50 
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debit. On the Issuing. Bank 1 side, it credjts the Correspondent Bank Moriey .account by S50 and debits the 
Honey Due account by S50 after receiving, the. $50 d^pqsjt .(St^^ 

In both illustrations, fifty dollars of paper cash is then transferred fronn the Correspondent Bank 2 to- the 
subscriber, vyhile.the Corresp.gndent Bank 2 debits its Money In Transit, account by $50:and ci'edits Its. cash 
5 account by $50 (iStep 8). The subscriber is now left with $50 of-pape|r,;cash and,;.in:the; first illustration. $50-.- 
of electronic notes 11 stored in his/her Transaction money module 4. . . . ■ ^ 

Figure 23, the. accounting, process for cle.aring the electronics money issued by: different Issuing. Banks 
is shown. This, illustration uses an example in which $100 of electronic nptps 11 .issiued.by Bank B has been 
deposited at Issuing Bank A, and $150 pf electronic note^. 11; .issued by Bank A: have b.e;en deposited at 
70 Issuing Bank B. j 

In Step' v. issuing Bank A transfers the $100 issued by Bank B to.the Clearing Bank 3. It then credits its 
Money Due^accpunt and $100 , and debits its Deposited at Clearing Bank account by. the same arhount In 
Step 2, Issuing Bank B depq?;its the $150 pf Issuing Bank A's money at the Clearing eank Sr Its, Mbhey ;Due ■ 
account.is credited by $150. while Its Deposited at Clearing Bank account is d.ebited $150. 
76 in sum, $50 is due to Bank B. Accordingly. $50 gets debited to the Clearing account of Bank A, while 
$50 gets credited to., the Clearing accpunt of Bank B (Step 3). 

In Figure 24, the accounting transactigns corresponding to updating electronic notes 11:;is shown. Kere;-. 
$100 of electronic notes 11 are stored in a transaction, money module 4 and are transferred to an Issuing 
Bank 1,. where $100 is credited, to the Money In Transit .account and, $100 is. debited to the Money . Due 
20 account (Step 1), 

One hundred dollars -qf electronic, notes 11 are requested from the Mon^y . Generator module 6 clausing \ 
the Money In Transit account to be debited by $100 while -the Money Issued - aceoDnt is credited^ by^ $100 - 
(Step 2). With this gccomplished,..the $100 of ^electrpnic notes 11 is transferred, frpm ; the Mgney. Geheratdr 
module 6 to the Issuing . B^nk'$ . i,. TeJl^r mgney . modul?! .5..;WhiGh in- turn .transfiersvthg money; to iithev: 
25 subscriber's Transaction money module 4 (Steps 3— 4;j. . * .■- . ; , 

Reconciliation'and Clearing .Systems u = . ■ • r ■ : 

Referring to Figure 25, th^ Transaqtion BecgnciJiation.Sy?^^ wilht?p understood- that; the/ - 

30 Teller money rnpdujes 5, the Money Qenerator modules 6 and the t?anklpg v.systen)..:20 m^y-rperiodicaliyrT- 
pass transaction reqords to Transactipa .Reponciliatipn System 22 majritained/at each, participating biaRk.'.u 
These transaction^ will be analyzed and matched to determine if there is any faulty process occurring ici the. 
systerp 20 of ^hejnyention. .„.. . , - \ 

The Transaction Reconciliation System, 22. .which may .be embodied .in, any appropriate I y,s|2.ed and- 

35 suitably programmed general purpose computer but is not so limited, will ensure thgt all Teller ^money : 
module 5 transactions with a financial impact, e.g., deposits, and withdrawals and payments, match. tl;ie': 
apprapriate agcounting transactions. Any mismatches could indicate incomplete- transactions or possible 
fraudulent actions. . - • 

Transactions reflecting the money ■issued by the Money Generator modules S .alsg shpuld corresponxl to 

40 Teller money module 5 transactions and have the appropriate accounting transactions recorded. Any 
mismatched data may indicate incomplete processing or. a security breach-. Unmatched .accounting 
transactions may be caused by incomplete transactions or an attempt to tatripeff with the repords gf the 
banking system 20. , , , ■ ' • 

In the preferred embodinnent, these unmatched transactions may pea p^ tr^ansfefr^ed. tQ ^n investigation 

45 system. 12 where the causes, of the. problems may. be determined. On -Jine diglpgues^nriay be provided to. 
allow investigators to review the mismatciies. against transaction records-. and to d.eitprminet/iappropriate 
actions to correct the situation. Investigators, may then take corrective actions by adjusting, accounts . 
deactivating fauity Teller money naoduies 5 and Money Generator modules 6, ancj- nptlfying subscribers of 
the actions. . ' .. -r- ■ ■ \ ^ >;-.-: -a , '. 

50 Attention, is now directed to Figure 26, which illustrates the clearing process for , handling .deposit . . 
transactions. Correspondent Bani<s. are not . involved . in this process because . subscn'b^r. d.epogi.ts .gre.: 
deposited to their accounts at Issuing Banks, 1 on a. real -time basis. At Issuing B.anks .deposits .ara. 
aggregated by the diearing' System 13 to consolidate all 'deposited electronic money (including the deposits • 
from Correspondent Banks), fpr transmission to the Clearing Bank 3. ..^ ; ^ . 

55 The Clearing Bank 3. may be irriplemented in any computer processing facility, capable, of. accom; - 
modating the large , number of transactions and corresponding , amounts of data which the sys|tern.i will 
typically, handle. A. high vdiume mainfrarn,e computer, a suitatply. sized minicomRMter system., a.num.ben of 
networked' work stations having the necess^iry data processing capabilities or combination of the .fpiregoing;; 
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may also be used. As will be appreciated by a person skilled in the art. the particular design of the Clearing 
Bank 3 hardware system is not critical to the invention. 

It is anticipated that Issuing Banks 1 may clear money in one of several procedures. In one of these 
procedures, electronic money may be deposited on - line from the Issuing Bank 1 to the Clearing Bank 3. 
This could be done on - line in a real - time mode when transactions are actually occurring. Alternatively, an 
Issuing Bank 1 may record the details of transactions being performed during the course of the day for later 
batch processing. Interbank processing could occur several tinnes a day. 

As shown in Figure 26, an Issuing Bank 1 may periodically transfer its electronic money to a deposit 
consolidation file (consolidate deposits) which may be processed and transmitted to the Clearing Bank 3. 
Transaction records from this file are also conveyed to the bank's Transaction Reconciliation system 22 for 
statistical and housekeeping functions. 

At the Clearing Bank 3, the deposit consolidation files are processed creating a single debit and credit 
by the monetary unit for each Issuing Bank's 1 demand account. Of course, the appropriate accounting 
transactions for these demand accounts are posted during the clearing processes. Any accounts which are 
overdrawn will be settled via the usual interbank settlement processes that are commonly used in the 
industry. 

The processed electronic money that is cleared is sent back to the Money Issued Reconciliation 
System 23 of each of the banks that issued it in order to be reconciled and checked for tampering and 
duplication. 

Additional statistical and housekeeping functions are implemented in the Money Issued Reconciliation 
System 23, as shown in Figure 27. Issuing Bank's 1 provide their own Money Issued Reconciliation. System 
23, typically embodied in a general purpose -computer but not so limited, for matching .the electron ie;mor?ey _ 
issued to the electronic money cleared at the Clearing Bank 3. 

As indicated in Figure 27. the electronic money issued and electronic money deposited; at ilssuing: 
Banks 1. and money cleared transactions received from clearing bank 3 are conveyed to the Money Issued 
Reconciliation system 23. The Honey Issued Reconciliation system 23 generates accounting transactions 
for the money cleared, and updates a master file of all the bank's money issued. Additionally, the^Money 
Issued Reconciliation system 23 passes to an investigation subsystem 13 money which has cleared but 
which was not issued or was possibly transferred more than once.. 

Any unmatched cases may indicate a potential breach of security. Investigators may then determine 
whether Money Generator modules 6 are not working properly or money modules are being tampered with. 
Money module identifiers of faulty or abused money modules are passed to each bank's Security Servers 
27 for distribution to the other money modules on the bank's local network 18. The identifiers are also sent 
to the Certification Agency 28 for appropriate distribution throughout the Network 25. 

Separately, the Money Issued master file is accessed by the Money Position system 24;which creates a 
file to be transmitted to the Clearing Bank 3 to create a consolidated money ppsition. It is contemplated that 
all Issuing Banks 1 will provide a report reflecting their position at the end of a specified period, typically at 
the end of every day. The Money Position System 24 may consolidate these reports to reflect the amount 
of money issued- by the Issuing Banks 1 for each monetary unit. The reports will reflect- the outstanding 
position of each Issuing Bank 1 in order to assess the risk of interbank settlement problems! 

Operational Sequences 



Although some aspects of the preferred embodiment may be described in terms of detailed schematic 
45 diagrams, the transaction functions are best illustrated by use of process flowcharts. Thus, to facilitate 
understanding of the operation of the money modules, several examples of transactions are set forth in the 
flowcharts of Figures 28-50A. Referring to these figures, a detailed description of the system processes 
and the associated application functions that incorporate the principles of the preferred embodiment of the 
present invention will now be described. 
50 Throughout the descriptions of the flowcharts (except where indicated otherwise), the application 
functions of the Transaction money module 4, whether they are imbedded in a hand -held . unit or other 
type of processing device, are hereinafter designated with the suffix '*A", and the Teller money module 5 
applications and its associated bank are hereinafter designated with the suffix "B". In the case where a 
Correspondent Bank 2 interacts with an Issuing Bank 1, the Issuing or Correspondent Bank 1 and its 
55 associated Teller money module 5 applications are hereinafter designated with a "C. 

Additionally, transitions to steps in another figure are indicated by a pentagonal tag having an 
alphanumeric symbol, and continue on the other figure with a circle having the same alphanumeric symbol 
therein. 
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Withdrawal From An Issuing Bank 

In Figures 28-35A. a pi'Gces's i Ibwchart of a transaction bfetweein a Transaction money module 4 and 
an telifer money in'odule 5 is showril In {h\s' process exampl^/ it is- assumed that ttie subscriber is desirous 
5 of cbmplEfting a nriohetary ti-ahg^ctioh With a participating bank: speeifitaliy, a withdrawal of sdme amdurit of 
electronic money from his/her account, to be stored in his/her TrarisSctiori money module 4; 

The process flow to set up a withdir'awal trahsactibri begins at-t'hfe top bf Figure 28v The first flbW bbck is 
a withdrawal set up between a money rnbdule A and a bank's teller rhbri6y nriodule B 5. which is describe 
further in Figure 29. This process begins with money module A performing a sigh -on process that is also 
10 described in further detail in another figure, specifically Rgure 31. 

Subscriber Sign ^ On- ^ 

Referring to the top of RgUre 31, the' ^'subscriber pronhpts his/her* Transaction money module 4 to 
15 perfoi^m a sigh ^ dn function (St6p- 1 0). The Session Manager 31 application receives the sign - oh m^sfsage 
(Step 12) and checks to see if the Transaction money module 4 has inhibited subscribers from signing* on 
(Step 14); ' 

Subscriber sigh -bn may be inhibited if S user makes severar unsuccessful attenhpts to sign-^dri^to' the 
Transaction money module 4. For example, the allowable attempts to sign -on may be limited to threfe, - 

20 such that if a person m^kes rriorg- than^ thY^'^-- consecutive - u sigh- on to 'the 

Transaction mdney nfiodule 4, 4h^ Session Mariager"^31 will prohibit' any farther sigri-ori -atternptST' 
Additibhally, this "lock-out" featui-e'^maV'' b^ ma^^^ period,; Such as 

twenty -four hours, for example. Such an arrangehribnt.will provide security from persons who come into 
possession of tfie Trahsaetion money nhodaie 4 but who ^re not prdpei-ly authbrized to access it: It should 

25 be noteid that while this type of an arrangement is anticipated' in the preferred embodiment of the inventi6n> 
the in\/feritidh. shblJld:;'nbt;b§. limited: as such, since any of the nriethods known in the industry for prdvidirig- 
security from unauthbt-ized persoris would be ^ 

When^the: sign ^ioh iS'-mt'Mh be the casei, To Subscriber 33 prompt^ ithe 

subscriber to enter his/his sign -on characteristics, such as- his/heir PIN and biometric identifiers (Step'22)i 

30 Inputs from - thb' subscriber : are- f^^ 31* to the^ To Subscriber 33 

application (Steps 24'^ 28), which: re'S'pdr'n'ds^ to v 'the. charactferisties entered- and entities- the subsdriber- to ' 
operate tHe/'Trarisaction- mdney module^' if the' subscriber's identifidationv characteristics are the' bbrreet ^ 
ones when compared to thbse stored in the membry bf the Transaction money module 4 (Steps 30 -^ 32). ' ''^ 
If the subscriber's identification 'characteristics do not m^^^^^ the identifiers: stored in-'memory, the To 

35 Subscriber 33 application notifies the subsdWbev of the invalid sign -on condition. (Step 34). From there; the 
To Subscriber 33 applifcatio'ri checks to see how mariy times the user has attempted' to sign-^oh (Ste'p 
36), and if the predetermined count has not been reached, the Session Manager 31 is notified (Step 38) ; 

The Seission Manager 31 works in conjUriGtlon with 'the Clock/Timer 43 applidation to set and to monitor' 
the time that has elapsed between unsuccessful sigh^dh attempts (Step 40). In' one embodiment/ too many 

40 unsuccessful attempts within 'the s^t timfe peribd will cause the' Sessiori'-Manag'er 3t to prohibit any furthfer 
sign -on attempts, effectively shutting down the Transaction money module 4. The Session Manager 31 
notes that the sign on is terminated in Step 42. 

Turning back to Step 14 of Figure 31, assuming that the Transaction money module 4 is inhibited, the 
Session Manager 31 checks to^ see if the predetermined' time ' period has ej^piired- (Step 16); If the 

45 Transaction money^ module- 4 is still in the prohibited sigri'^bn inode, the' To Subscriber 33- sends a 
message to the subscribei- that further access 'to the Transaction money module 4-iis.ptOhibite'd (Steps 18-^ • 
20). The Session^ Manage!^ 31i nbtes that the ^ign ^ oh attempt is terminated, again in step'42i i 

Setup Withdrawal . vn. : ■ 

50 ' " ■ . ' . . • ■ 

Turning fo Figure 29. when a proper sign-on is adcomplishfed, the To Subscriber A 33 pr-ompts the' 
subscriber for the type of transaction thaiis desired- (Step 43). As ririentioned previously., it is anticipated 
that a subscriber may- transact with any one"' of a multitude :of a^^^^ at' several different participating 
banks and financiai institutions: . . - ■ - 

55 After selecting the particular bartk and acicouht (Step 44), the. Trahsaction money module 4 initiates a 
procedure for ;eommunicating with the bank that was selected, by engaging the Network 25/ The overall 
prbgrsim flow now passes to th^ procedures illustrated by flowbharts in Figure 33. In Figure 33,- there \s 
shown the data processing and flow for implementing a sign - on to the Network 25. 
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Network Sign - on 

The illustrative Network 25 sign -on method about to be described is in general applicable to any of the 
money modules 4.5,6 of the present embodiment. Thus, in this example. "A" denotes any class of money 
5 module. 

After the bank that is to be accessed is selected, the money module Initiates communication with the 
Network 25 under the control of its Session Manager A 31 (Step 50). The Network Server 26 begins by 
requesting the certificate of the Transaction money module 4 from Session Manager A 31 (Step 52-54). 
The Maintain Security A application 37 retrieves and sends the certificate to Session Manager A 31 (Step 

TO 56). Session Manager A 31 sends the certificate to the Network Server 26 (Step 58). which, upon receipt, 
routes it to the Security Server 27 (Step 60). 

The Security Server 27 tests the certificate to check its validity (Step 62-64), and If it is not valid for 
any reason, the Security Server 27 will signal the Network Server 26 to deny access (Step 66). The Network 
Server 26 may In turn convey an access - denied message to Session Manager A of the Transaction money 

75 module 4 (Step 68-70). 

If the Session Manager A that receives the denied access message is a Transaction money module 4, 
its To Subscriber application A will inform the subscriber of this condition (Step 74). If it is a Teller money 
module 5 or Money Generator Module 6 that is trying to access the Network 25, the To Bank A application 
■ 47 notifies the bank's systems 20 that its access will not be permitted (Step 76). v 
J 20 Assuming the certificate validity check is satisfied, the Security Server 27 sends an updated list^of. the 
bad money modules, and a new list of certificatory keys to the Session Manager A, (Step 78, Fig. 33A)^The 
keys are signed using the last version of the certificatory key. This information is received by. Session 
Manager A and forwarded to the Maintain Security A 37 application, which will validate the certificatory. ke^o. . 
list and the bad money module list (Steps 80-82, Fig. 33A). - . 

25 Public Key A 44 tests the validity of the signature (Step 84) and if the signature is not valid, a message^ 
warning of a network security problem is sent by the To Subscriber application A 33 of a Transaction - 
money module 4 (Steps 86-90), or alternatively, by the To Bank application A application of s-": Teller 
money module 5, (Steps 86-88. 92), Advantageously, all money modules will check the vaiidify of a 
signature received from even the Security Server 27. This helps to ensure the integrity of the'overall - 

30 system. 

In the case of a valid signature, Maintain Security A updates the bad money module list and the 
certificatory key list. (Step 94). If the certificate Is to be recertified or the certificate has expired (Steps 96 * 
and 98). the Maintain Security A generates a new certificate (Step 126 of Figure 33C) while Public Key A 
generates new keys and signs the certificate using the old public key (Step 128). Session Manager A sends . 
35 the new certificate to the Security Server 27 who takes the certificate and tests the validityrof the signature - 
(Steps 130-136). ■ ■ 

Assuming that the signature of the new certificate is not valid at this stage, Steps 66^^:76, Fig, 33, are 
X repeated so as to terminate the communication link into the Network 25. 

} On the other hand, a valid signature. Rg. 33C, will allow the Security Server 27 to sign the new ' 

40 certificate and send it back to the money module (Step 138). Session Manager A 31 receives the new 
certificate, Step 140. Fig. 33D, and forwards it to its Maintain Security application A to again validate the 
certificate through use of the Public Key application (Steps 142-146). Here, the money modules will repeat 
the test of the validity of the certificate issued from the Security Server 27. For a valid signature, the 
Session Manager A 31 sends an acknowledgment to the Security Server 27 (Step 1 48) who responds by 

45 returning the process to Step 78. Fig. 33A. 

Conversely, If the Security Server's signature on the new certificate generated by Transaction money 
module A proves to be invalid, Fig. 33D. Session Manager A will send an invalid certificate message along 
with the certificate back to the Security Server 27 (Step 150). which will again attempt to validate the 
signature on the certificate (Step 152). A valid signature will return the process to Step 66. Fig. 33. 

50 Alternatively, an invalid signature will cause the Security Server 27 to disconnect from the Network 25 (Step 
156; Rg. 330) and cause the Network Server 26 to notify the money module of a malfunction (Step 158). 

The Session Manager A that receives the message (Step 160) will, in the case of a Transaction money 
module 4. get the To Subscriber A 33 to inquire of the subscriber if they desire to retry the whole process 
of signing on to the Network 25 (Step 164 & 168). fn the case of a Teller money module 5 or a Money 

55 Generator Module 6, the To Bank application A will inquire if there is a request to retry the Network 25 
sign -on procedure (Step 166 & 168). 

No attempts for a retry will, of course, end the communication link into the Network 25, and conversely, 
a request for retry of Network 25 access will return the procedure back to Step 56, Fig. 33, wherein 
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Maintain Security A will again retrieve the Transaction money nnoduie's certificate for the Network Sferver 
26. 

Back at Step 98i. Fig. a3A if the certificate, does not need to be recertified -dr has not expired-. Session 
Manager A. 31 will request the date and time (Step 100) from Clock/Timer A (Step 102, Fig. 338), and 
5 forward this data to the Network Server 26 (Step 104). 

The Network Server 26 checks the time and date after receiving it (Step 106) and if it is outside of an 
acceptable predetermined parameter, this Network Server 26 will send the 'new time and date (Step'1 10) td 
Clock/Timer A through Session Manager A (Steps 112 & 114). If Clock/Timer A 43 cannot adjust th^ date 
and time tp be synchronized with. the. Network 25, the operator of the moneV module for^ subscriber of' the 
10 bank is notified: of the. clock malfunction (Step 11 6.-.124J. .': . 

In response to the apparent malfunction, the operator may attempt . to have the-tirfie and date resent 
from the Network Server 26, Step 124, and the procedure reverts back to Stdp 1 02- in which.it 'dftempts to 
send the new date and time to the money module. Alternatively, an acceptable date and time check, Step 
1 08 allows the Network Server 26 and Session Manager A to exchange acknowledgennents and ndte the 
/5 successful Network 25 sign - on (Step 126 - 128). 

Establishing A iSession ; .. 

As shown In Figure 29, after the steps of money module Sign -on. transaction selection and' network 

20 sign -on are completed, sessions are established between the money modOles. Figure 34 diagrams the 
flow, process for estabjishing a money -module to' money -module. session, which, as will be understood by 
one skilled ifi the art. will in general be applicable as well to other sessions established between the various 
types of money modules.. of the present invention. 

Referring to the top of Figure 34, the Session Manager A. will'first dhe'ck tc see if. thef subsdrib^r has- 

25 requested.. connection to a specific destination in the Network 25. (Step 190). For instance, Where a 
subserib.er is desirous -of* transacting with his/her. account at- a specific bank, the Network 25 will connect thei- 
Transaction ^money module 4 to the selected bank. Steps 132-198. Conversely, when- a- subscriber* is- 
performing:- updating functions, on the Network, 25i; there is- no need: to establisJh ai-sessibn .with ^^ny speciffc 
bank, and the Network server- 26 may decid$ where to rdute 'the conneetioh. based on Network' 25 .tFafficv' : 

30 If a specific destination has been selected by the subscriber. Session Manager A conveys the 
destination information to the Network Server 26 (Step 194). The- Network Server: 26 initiates a com rhu ^ 
nicatiori link'to 'the money module of the selected destin(ation;s(Step, 196) and Sends an .acknowledgement td 
Session Manager A 31. - 

After receiving, the acknowledgement that the destination money module has been coritacted (Step 

35 198)j thg Maintain • Security application A will send; its certificate ..to the. Maintain Security 'application. B 
through each application's respective Session Manager (Steps 200-206). 

It is anticipated that the: money modules will exchange certificates to verify that each money module/is 
interacting with another valid money module. To this end (ag seen in Fig. 34 A), the Public Key application^ B • 
44 Jests the: certificaje of , money module A by using, the: p;ub lie : key algorithm and the public key 

40 corresponding to. th^ private key used by.money module A; to encrypt and check A's. certificate and verify 
thatjt;is.yalid .(Step.,208). •. . ■ 

-.!f „th^ certificate is found invalid, the sessioh Manager B will note the session is;terminated (Stfep2rO). 
In the- case, of a Transaction inqney mpdule 4, the To Subscriber. B informs the subscriber of the trarisaction 
terriiination (Setup. 21 2). Likewise,, a Teller money module: 5 of Money Generator Module- 6. uses the To - 

45 Bank application B 47 to notify the bank of the termination, Step 213. -lt is anticipated that the counterparty : 
money module will then timeout to end'the.' exchange. .. , , 

In. Step 2l4, .Fig. .34A. assuming: that: the;, certificate of money module A is valid, the Maintain Security 
application 3 -37: qhecks to see if Transa.ctipo .mp.ney module- A. is on the list of compromised money 
modules „(Step 21;3)> If money module A is on that: list; the;pmce5s fldw returns to. Step.2l0':so: that the. 

50 cornmunications c^n be terminated. ... i. 

Alternatively,, vyhen money module A is. aot on;;t^§ list- Qf compromised money modules,, then Random 
Nurpber Generator B 46 creates a session .key (Step 216) and encodes the session key. along, with . money 
module B's certificate.. an?i a verification message,, using; tnoney nriodule A*S; public, key (Step 218)v This 
encpdecj message .is sent to money module A by Session Manager B .31. (Step 220). 

55 .Session Manager A 31 receives>.the message from money module. B (Step 222), and uses its Public; 
Key 44 algorithms application to decode the message (Step 224. Fig. 34B). and to- Verify ^money module B's 
certifica^eA($tep 226)-. . . . ./ . .. 
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If the test determines that money module B's certificate is invalid, the operation branches to an "abort 
transaction" procedure to terminate the steps taken thus far in establishing a session {Steps 500-524). This 
procedure may be used, for example, to end the communication session and to functionally shut off money 
module A, which results in the communication link ending. (Steps 500-524. Rgure 32). 

5 

Abort Transaction 

Branching to Figure 32, the functional shut -off of a money module through the abort transaction 
process will now be described in detail. It will be understood that the following process may be used when 
10 any two money modules are abnormally terminating the transactions occurring between them. Accordingly, 
the money modules will be designated "X" and "Y" to illustrate the generic applicability of the process 
steps: 

An abort transaction process initiated by money module X to terminate communications with money 
module Y begins with Session Manager X 31 capturing and then reversing or rolling back any programmatic . 
75 changes that were made to the money module (Step 500), and then noting that the session has been 
aborted (Step 502). 

In the case where the money module that is initiating the termination is a Transaction money module 4, 
the To Subscriber application 33 informs the subscriber of the communication termination (Step 510). 
Likewise, a Teller money module 5 informs its To Bank application 47 of the termination so..tbat any 
) 20 accounting changes may be undone (Step 508). Next, the Session Manager X 31 of the terminating, /rtpney 
module sends an encoded message to the other money module involved (Step 512). . . 

Briefly referring to Figure 37, all encrypted messages between- modules will be provided.. jiy^^^^O^ 
following steps. The sending money module (here also referred to as "X") uses its Symmetric Key 45 to . 
encode the message to be sent to the receiving money module (here also referred to as "Y")^. (S.tep:42).; 
25 Again, it will be appreciated that there are a number of known encryption techniques which may be utilized. 

The Session Manager X 31 sends the encoded message to Session Manger Y 31 which. ,i^ turn 
decodes the message using its Symmetric Key Y 45 (Steps 4-8). 

Continuing with Figure 32, the Session Manger Y responds to the termination notice sent by also 
undoing any changes it may have made towards establishing the session, and noting the aborted session 
30 (Steps 514-516). If it is a Transaction money module 4 that is now shutting down, the To Subscriber 
application 33 alerts the subscriber of the condition (Step 518 & 524). Correspondingly, in a Teller money 
module 5. the To Bank application 47. will reverse all accounting transactions that have been undertaken 
(Steps 518-522). 

Returning to Figure 348. assuming that the money module B certificate is valid, in Step ,228 Maintain 
35 Security A checks to see if money module B is on the list of compromised money modules. If money 
module B is on the list (Step 230), the session reverts to the. abort transaction procedure, Steps 500-524. 
Thereafter, the communications session is dissolved. 

More typically, money module B will not be on the list of compromised money nnodules, and the.. 
^ Clock^'Timer A 43 will retrieve the date and time (Step 232) and send this information to the Maintain 

40 Security application A 37 so that the verification message may be assembled with the date, and time (Step 
234). 

Symmetric Key A 45 then encrypts the verification message with the date and time information, using 
the random session key provided by money module B (Step 236). Session Manager A 31 sends this 
encrypted message (Step 238) to Session Manager B 31 (Step 240). From there, the Symmetric Key 

45 application B 45 decrypts the message (Step 242) and passes it to the Maintain Security B 37 for message 
verification (Step 244, Fig. 34C). An incorrect message will cause the session to be aborted through Steps 
500 - 524, while a correct message will advance the procedure so that Maintain Security B 37 can compare 
the time and date with that of money module A (Step 248). 

Clock/Timer B 43 will verify that money module A*s clock is within a preset amount of deviation from 

50 the clock of money module B (Step 250). If the discrepancy between the two clocks is greater than a 
predetermined amount, the session will be aborted by branching to Steps 500-524. 

If there is no discrepancy that is greater than the permissible amount, Session Manager B 31 will note 
its start of a session (Step 252). and send an acknowledgement to money module A to start the transaction 
(Step 254). After the encoded message is sent from money module B to Session Manager A 31 using 

55 process steps 2-8. Fig. 37, Session Manager A 31 acknowledges the message receipt and also notes the 
start of session (Steps 256-258). 
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Request Withdrawal . ...^ 

' After a sesision is established between the Transadtien rhdhey- rribdule: A and Teller money modale 5* 
the Transaction money rinbdule 4- rhakes a withdrawat'ffequest fr6rn th6*^ Teller mb'ney rtiodule 5. See .Figure 

5 29. Referring now to Figure 30, a process for requesting a withdrawal will now be described. It should be 
noted that although the figure denotes the parties as "X" and "Y." in the process steps describe b^ldw. 
they are applicable to any money module transacting with a Teller money module 5. 

To begin, the To Teller X 34. sends a withdrawal request to the Tellei" mdney module 5. requesting a 
certain amount of money to be withdrawn from a specific acdbunt; In its transmission of the withdrawal 

10 reqijeSt, the abcount number and the account profile will be transrfiitted from the requesting money module 
to the Teller money- module: 5 (Step 700). To send this request, the process Step^ :2^8 are repeated, in 
which the message is encrypted using the previously described cryptographic techniques. 

Validate Account Number 

;5 ■ • 

Once the withdrawal request and the account number and profile are transmitted to tH^ Tellel' monfey 
module- S, a proe'edure t"Q validate the^ account number -is : initiated (Steps 7041^> 7G55)> A flow diagram 
depicting how ain account number is validated is shown In Figure 38.^ ■ - 

In this' process, the Maintairr Security aipplication 37 of the Teller money module/ 5 receives the account 

20 profile and signature and conveys them to its Public Key application 44 to verify the' profile signature (Steps 
7041 -7042). The signature is tested using the public key generated and distributed by the Bank's Secdrity 
Server 27. An invalid signature causes the Maintaifi Security 37' application to inforni th'e Session Managbr 
that, the aceount profile is invalid (Step 7044), whereby Steps 500 ^524.-. Fig.. 32. are foliov^ed to abort the 
transaction betweea the 'two money modules/ ' ' \ • * . - -^ " ' ' ' > - ' 

26 If the sighatijre test confirms a valid signature, the procedure advances tb the 'To Bank* application 47 
which; sends- the* account -nurfib'er' it has received on to the bank's computer' systems' (Step: 7046). An 
inactive account will cause the Maintain Security appliciation 37 to inform the Session. Manager of the 
inactive account (Step 7048)' and have the -transaction aborted following steps- 500^:524; an account that 
has- not beenvinaetive will allow the^ Maintain Security. application^37 to check if ^e accouht'pro'file/needs to ■ 

30 be recertified (Steps 7047— 7050)i • . : . . . ^ , ... , . , ,! ; ^ ' * 

If the account profile does need to. be recertified .'the ^Maintain Security application .;37 will tb'send.the 
account profile to-the Security- Server 27 .(FiS; 38Av Steps 7051 >^:^7052)/' when will reefe^rtify thef account ' 
profile and send it on to the Teller money module 5 (Step 7053). In response, the Teller moWey mbd'uie 5 
sends it to the money module making the withdrawal request (Step: 7054)i • , . . 

35 The communication from the Teller money- module 5 ta the' money module utilizes the previously 
described routine- for sending messages,; Steps. 2 8. Th'e Maintain Security ap'plieatidn. 37 then updates the 
account profile in the money module and returns an acknowledgement to the Maintain Security application. 
37 in the Teller money module 5 (Step* 7055), iaiso' using Steps 2-; 8. The electronic message is received 
by the Maintain Security application . 37 of ithe Teller rndh'ey module 5. and acknowledged in Step 7056. 

40 • -With the account infornrtation. cheeked, 'the process returns to Step 704 of Figure 30. The To Bank 
application 47 now verifies that there are sufficient funds to support the withdrawal request (Step 704). 
Sufficient iuhds will pronhpt the return of an acknowledgement to a Transaction nhohey module 4, utilizing 
proG'ess; Steps"2-8 to transhait the ackiibwledgemeht to. its To. Teller 34 application, fuhction (Steps 706- 
71 4).' In. th'e- case of a. Teller money module 5, ho aGkhowledgem''ent is- required.. . . • 

4s ;ln the case of. d Transaction, money module 4; an; insufficient arhountf of funds will cause the subscriber ;. 
to :be prompted to enter a hew amount for the withdrawal (Steps 71 8 -^ 720,"^ Figure 30A). As shOwn by . Step 
724;;the newly entered amount causes the To Teller application 34 to siend the new i-equest^to the To Bank- 
application 47 (using Steps 2-8) of the Teller money module 5 to verify if there .are sufficient funds.io . 
cover ;the latest requested: amount, returhing -to Step 704 of Fig. 30. If the: new request ife still greater than 

50 tha funds oh. balance at the bank, the Teller money module 5 will initiate- Steps 500-524 to abort the- 
transaction between the to money modules. : In the. ease, of a Teller money module 5, the. : transaction -ia; 
allowed to. overdraw the'account. .. 

Transfer Notes 

55 . 

Referring back to Rgure 29. To Teller A 34 transfers the total of its cui*r6hcy riotes 11 to; the Teller 
money module 5 (Step 45). If there are no notes 1 1 being held in the Transaction money module 4 at the 
time the withdrawal request is made, the To Teller A application 34 sends a message to the Teller money 
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module 5 that there are rio riotes 1 1 present (Step 47). using process Steps 2-8. 

Electronic notes 11 are transferred between money modules using the procedure described below 
(referring now to Figure 39). The Note Directory application 39 of the transfer or money module chooses the 
notes 11 of proper values for the transfer (Step 750),. and has the Notes application 40 create a transfer for 
each note 11 (Step 752). The Public Key application 44 creates signatures for all the notes 11 (Step 754) 
and sends the notes 11 to the Packet Manager application 41. for assembling the note 11 transfers and 
signatures into a packet to be sent to the requesting money module (Step 756). 

Steps 2-8 are utilized to transfer the packet of electronic notes 11 to the Packet Manager application 
41 of the requesting money module for receipt and disassembly (Step 758). The Verifier application 42 
verifies the transfers appended to the certificates, and verifies that the total amount conforms to the notes 
11 that should be sent (Step 760). 

Any invalid information will cause the transaction between the two money modules to be aborted, using 
the procedure outlined in Steps 500-524 above (Step 761). Valid notes 11 will have their 'ex pi ration dates 
checked (Step 762) by the Verifier application 42 when it is a Transaction money module 4 that has 
conveyed the notes 11 (Step 763). Any expired notes 11 (Step 764) will cause the sessions to be aborted 
using the procedures outlined in Steps 500 - 524, Fig. 32, 

Assuming the notes 11 have not expired, or in the case where a Teller money module 5 is accepting 
them, the process flow resumes at Step 765, Fig. 39A. In this Step, the Public Key Y application 44 verifies 
the digital signatures, invalid signatures invoke the transaction abort process of Steps 500- 524. • . 

Valid electronic notes 11 are then sent to the Notes application 40 (Step 768) and the Note Direptory 39 
is updated with the new note locations and amount (Step 770). , . , . 

Returning to Figure 28, the To Transaction 8 49 checks if the electronic notes 11 have been trap.sjer/ed 
(Step 772), and if notes 11 have indeed been transferred from a Transaction money module 4. accounting, 
transactions are posted to reflect this situation (Step 776; see also Fig. 14, Step 1) by the i To. Bank - 
application B 47. Both in the case when no notes 11 have been transferred from the money rnodule,^and. 
after the later accounting transactions are posted in Step 776, a session is established between th^^^Teller 
money module 5 and the Money Generator module 6 using the procedure outlined above in Step%,:l90- 
258. Figs. 34. 34A-C- 

As notes 11 are requested to satisfy the withdrawal, an account posting occurs to reflect the request. 
The To Bank application B 47 will post the proper accounting transactions (Step 778, Fig, 28) as also 
illustrated in Figure 14, Step 2. 

Request Notes 

35 Directing attention to Figure 40. notes 11 may be requested between Teller money, modules S and 
Money Generator modules 6 using the following procedure described below. 

The To Money Generator application 48 of the requesting Teller money modulei 5 will issue; a request 
for a specific amount of electronic money to be created (Step 780). The request will be sent using the 
above described Steps 2-8 for encrypted transmission, to the To Teller application 34 of the Money 

40 Generator module 6 so that the Money Creator -application 50 may be activated (Step 784) to create the 
electronic notes 11 (Step 786). 

After the creation of electronic notes 11. they are signed by the Public Key application 44 of the Money 
Generator module 6 (Step 788) and placed in a holder by its Notes application 40 (Step 790). Finally, the 
Note Directory 39 is updated with the information about the newly created electronic notes 11 (Step 792). 

45 The process flow now returns to the procedures shown in Figure 28. The requested notes in the Money 
Generator module 6 are transferred to the Teller money module 8 5 using the process Steps 750-770 
outlined above for transferring electronic notes 11. The notes 11 are then transferred from the Teller money 
module B 5 to the Transaction money module 4 using these same process Steps 750-770 for 
transferring- electronic notes 11. 

50 Finally, to successfully complete the withdrawal of electronic notes 11, the money modules will 
"commit" to or finalize the transaction by utilizing the following procedure. Referring now to Figure 41 for a 
detailed description of this process, the Tran Log Mgr. application 36 updates its Tran Log to record the 
transaction that has occurred above (Step 690). When it is a Transaction money module 4 that is 
committing to the exchange (Step 691). the To Subscriber application will notify the subscriber that the 

55 transaction has been successfully completed (Step 692), Of course, the Session Manager application A 31 
will note the end of session (Step 693), and employ process Steps 2-8 to send the message to the money 
module it is transacting with. 
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With this end of session notice received, the other money- rtiddUle, -in this ejicimpie a TellehMoney 
module 5. will use its Trairi Log Mgr. application- 36 td update its own Trah Ib'g (Step 694). Assuming, 
however, the' seedndTnohey' 'module receiving the end of sfessidh notice 'is hot ^ Teller rtidridy nriddul^-Sran 
additional step of -having the To Sbbscnber application 33 hbtify the subscriber, of the end of the tr^hssiction ' 
5 occarreheS (Step 696} will Ido riec^ssary. therieaffer. the Session Manager 31 of tfife second rhoney mdduie-- 
in both cases wilf Sisd make' note of- the' end of- the session i[Step 698), ' ■ ' • ' ' 

Directing attention back to Figure 28'} the- process to commit is initiated first by the transaction nridriey 
module 4 committingj its transaction with the Teller rtioriey module B 5 (Stefis 69G -698)'. The process steps 
are also applied td^ commit the tiransaction between Teller money mdduie B 5 and the Money GeneiratdH 
70 module 6 ^ (Steps 690-698). Tha^t completes the proceissing for one coriiplete withdrawal of elfectroni'e 
money from an Issuing Bank 1. 

Withdrawal From A CdrreSpbndent Bairik ■. ^ / 

75 A withdrawal frdfti a Correspondent B'arik 2 will now be described; afded by i*eferehce to Figure 35. To 
begin, the previously described Steps 43 - 48 to set up a withdraWal iaFe' Undertaken by a Transa'ctibh 
money module A 4, ^iri^ ciDrijunctidh With an Teller mdrie'y module B 5v Ne')rtv Steps- 190 -258; Osfed^to 
establish a Session; a'Isd described' above, are initiiated between Teller rhoriey ino'dUle B'-S^ and Teller money 
module C 5. After the s'essiohs have been established, the To Sank "appiicatidri -B 47 -will posf the 

20 accounting transaction cdrfespdhdirig' to' the* withdrawal thdt is gding td subsecljueri'tiy occur (Step 900; see 
- also Rg. 13. Step 1). : . . . . 

AS previously noted, it is cohtehri plated that' wheriever^a Trarisaetidrt 'mb'ney moduli a 
bahk, both Issuing ;i and Cerrespdhdent 2, all electronic notes* 11 i that are stored within' the Transaction 
mdhey mdduie 4-are Vembved ^nd -replaced 'with '^electitohic ribtes i1 (^entainirig' the' rtidst recent certificate*.' 

25 To perform this dpei^ation, Td Trahsactidh B 49 will tlieck to see' if= there are notes 1-1 stored within the 
Transactioh^ meney rfidduie- 4 (Steps 902-9()4): If fHefe ^ are ridtes 11; To Bank B 47 will post the 
appropnate^ ac'cduritiilg-trahsabtidns (see accounting procedure illustrated . in FiguVe 1'3: Step* 2) (Step 906), 
and perform a deposit request from the Teller money module C 5 (associated with an Issuing Bank 1) to' 
retto the notes 11 that need to be: replaced. ' . 

30 For a detailed description' .for performing :a deposit request; aftentidrt Will- tDe'directed to Rgure'44. -Here.- 
the To Teller application 34 sends a deposit request message, the amount of 'the deposit td be serif, the^ 
account number and the account profile of the account to which the notes 11 will be deposited (Step 920). 
This information is transfen-ed to the Teller money module 5 using Steps 2-8 for sending messageisi and 
then Steps 7041 - 7050 (see Figure 38) are performed to validate the account profile and number. 

35 In the case where- the depdsitdr is a Trahsactidh mdney module 4. the To Trarisa6tion apib[icatidn*49 of 
the Teller money module 5 will send an acknowledgement td the- Trah'sac^^ module 4 that t^re'' 

transfer of notes 11 is ready to proceed (Step 924). Altefnatively,;if ifts another Teller money mdduie 5 that 
is making the^ deposit, it is the To teller application '34' that issues the ackhowledgement to . the' Teller 
money module '5 (Step 926). ■ ' . ' 

40 In either case, the acknowledgement is encrypted arid transmitted using the procedure outlined in Steps 
2-8. whereby it is received by a To Teller application 34 of a depositing money rribdUie (Step 928)r. c i ' 

Referring back td Figure 35, once- the deposit request is. completed, the notes 11 are transferred from 
the Teller money module B S to the Teller rtidney module C 5 Using Steps 750^770i Figs. 39; 39A detailed 
above; for transferring -notes. Accordingly. To Bank C 47 posts the proper accountirtg trahsaGtidnS ' (see - 

45 Figure 13. Step 2) to^ reflect 'this transfei' of notes 11 (Step 908). In Teller mdney module C 5, the To Teller 
appiiGatidri .34 acknowledges ' the deposit by -sending a; ^tnessage b^ek to ihe To Teller B 34 application 
(Steps 910^912). Using Steps 2^8. NetUrally; the To Bahk Bi47 wilhnow piost its acGouhtirig transactions to 
reflect the withdrawal request it has made to Teller money 'module G 5 {Step 914; see also Rg. 13. Step 
3). ^;; r 

so After all electronic notes 11- have been removed from the Transaction' money module 4 and-the proper 
accounts have ' beemposted, a withdrawal is. re'que^ted dfia -tdtaf anhdurit ithat. includes both the amount 
originally requested to. be withdrawn frdrh the subscriber's barik':aGGdurit and the amount that was removed 
from the Transaction money modUIe 4 to be replaced with updated, electronic. notes 11'. 

The withdi-awal request is performed between Teller-mdney mdduie B S and Teller money module C 5 

55 using the process Steps 700 724, -Figs. 30* 30A. described above; Teller money module C 5 transacts, with 
Money Generator module 6 to withdraw new electronic money and in doing So it establishes a* session 
between the two modules using the process Steps 190-258, Rgs. 34. 34A-C. . : ' ' 
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The electronic notes 11 are requested by the Teller money module C 5 from the Money Generator 
module 6 using process Steps 780-792. Rg. 40, and the notes 11 are transferred from the Money 
Generator module 6 to the Teller money module C 5 using the Steps 750-770. Figs. 39, 39A. 

The To Bank application C 47 performs the accounting postings (Step 916; see. also Fig. 13, Step 4). 
5 After this, the electronic notes 11 are transferred from Teller money module C 5 to Teller money module B 
5 using the Steps 750-770: the notes 11 are than transferred to Transaction money module A 4 also using 
Steps 750-770. 

To finalize the withdrawal from the Correspondent Bank 2, each money module must commit to the 
transaction it has just had with the corresponding money module. Thus, Transaction money module A 4 
ro commits to Teller money module B 5 using Steps 690-698. Rg. 41, and thereafter Teller money module B 
5 commits to Teller money module C 5. Rnally, Teller money module C 5 commits to the Money Generator 
module 6, using the same process Steps 690 - 698. 

Deposit To An Issuing Bank 

Referring to Figure 42 in combination with Figure 43, an example of a deposit to an Issuing Bank 1 will . 
now be described in detail. To start the transaction, a deposit set up must be done which uses the process 
steps shown in Figure 43. 

^- In Step 398 at the top of Figure 43. the subscriber decides to deposit some money to a banjc After 

\ J 20 performing the sign -on routine for a Transaction money module 4 (following Steps 10-42, Rgav:;.31 - : 
31 A), the To Subscriber A 33 prompts the subscriber for the transaction desired (Step 400). 

In this example, the subscriber chooses the deposit transaction, the amount to be de posited. ^ and the- 
bank and account number in which to deposit the electronic money (Step 402). Before any other 
procedures, Note Directory A 39 checks to see if the money module contains funds sufficient to^suppjort^theA.- 
25 deposit request (Step 404). . . 

Assuming there are insufficient funds for the deposit, To Subscriber A 33 prompts the subscriber for a 
new amount (Step 410) and if no new amount is selected, the Session Manager A 31 informs the sui^scriber 
that the transaction must be terminated (Step 414). If the subscriber enters a new amount, Step 4ii2, the 
process flow returns to Step 404. Wherein the Note Directory 39 application again checks for sufficient 
30 funds for the transaction. 

Assuming there are adequate funds within the money module, the process flow advances^-.to the 
Network 25 sign -on procedures outline in Steps 50-168, Figs. 33-33A. A successful Network 25} sign - 
on then advances the process flow to Steps 190-258. for establishing a session between the Transaction^ 
money module A 4 and Teller money module B 5. 
35 Once the session is established between the two money modules, the deposit request^steps outlined in .. 
procedures 920-928 are followed conveying the request from Transaction moneys module A 4 to the. Teller 
money module B 5. The To Teller A 34 transfers all of the electronic notes 11 stored within , the. money 
module to the Teller money module B 5 (Step 408) using the Steps 750 - 770 described above for 
' , ' . transferring electronic notes 11 between two money modules. 

40 Continuing with Figure 42, the To Bank B 47 posts the accounting transactions for the notes deposited 
(Step 418, see Fig. 12 Step 1). In Teller money module B 5. the To Transaction application 49 checks to 
■ see if the amount deposited is less than the total notes 11 that were stored in module A and then 
transferred to the Teller money module 5 (Step 420). If the deposit is less than the total amount of 
transferred notes 11, updated notes 11 must be generated and sent back to the Transaction money module 
45 4. 

When all the notes that are contained in the Transaction money module 4 are deposited, i.e., the 
amount to be deposited is not less than the total amount of electronic notes 11. the To Transaction B 49 will 
send an acknowledgement to the Transaction money module 4 (Step 428) using the Steps 2-8 for sending 
messages between money modules. The To Teller A 34 receives the acknowledgement (Step 430) and 
50 initiates the Steps 690-698 to commit the deposit transaction between the two money modules. 

When the electronic notes 11 removed exceed the desired deposit amount, new updated notes 11 must 
be returned to the Transaction money module 4. To perform this, the To Bank application B 47 of the Teller 
money module B 5 posts the proper accounting transactions (Step 424: Rg. 12, Step 2). Thereafter, Teller 
money module B 5 establishes a session with the Money Generator module 6 using process Steps 190- 
55 258, and requests electronic notes 11 from the Money Generator module 6 in the amount that should be 
returned to the Transaction money module 4, by performing Steps 780 - 792. 

The electronic notes 11 are created by the Money Generator module 6 and transferred to the Teller 
money module B 5 using Steps 750-770. With the electronic notes 11 in the possession of the Teller 
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money nriodule B 5, they are transferred to the Transaction money moduli A 4 using Sti^ps 750 -'770. ' 

■ Aft^r Transaction nhbhey module A 4 recStv§s the electronic notes 11, it nriust' finalize the tfarisac'tion by 
committing Teller money module B 5 to Transaction m'bhey rhodule A 4 'usirig StepSs 690-698; Likewise. 
Tellbr rtibney module B 5 musit dommit tb the Money GeheKatdr module^ 6 using th^' sarhe Steps 690 - 698. 

Deposit To A Cori'espbhdent Bank . ; . 

Figure 45 iltustfates the process fibw for a deposit at a Coirespbndent Bahk: In depositing to a 
Correspondent Bank' 2. the' deposit set up described in Steps 398 through 414 are repeated in the first 
10 stdge of th6 trahsSctioh. From there the To Transaction 6 49 tests to see if the deposit is less than the total 
anriount of' electronic notes 11 that have been withdrawn in the deposit set up procedures that were just 
processed (Step 440). 

In the case where all the electronic notes 11 stored in the Transaction money module 4 are equal to the 
amount of notes 11 to be deposited, then To Transaction B 49 sends a deposit acknowledgement back to 
/5 the Transaction money module 4 (Step 444). using Steps 2-8 to send the message from the Teller money 
mo'duie BS tO' Transaction "nn 6 hey module ■■' - ••' • 

On the Transaetibh money moduli 4 side; the To Teller 34' applicatfoh ^eceivds the ackribwlfedge'rheht 
(Step 446) and uses Steps 690-698 to commit the transaction with Teller moridy ' rtibduie^ a 5. The 
Transactitih money .module 4 is now* finished arid' remb\/ed ffbm the prbces'S:- the fihalization of lh§ dfepbsit 
20 provides for- the adeourit posting trahsaetib:ns to bei made by the To Bank application' 47 (Step 448): See 
Rgure 11, Step 1 for the accbuntirig trahs&ctiohs; ' • ^ ^ ^ ^ • 

A 'sgsisibhs is how established bStWeien the Teller = money hnbdule 8 5-arid teller* imortey module G-5 
usirig Steps 1 90^258, 

' Teller money -module B 5 issu^s^^'reqU'es^ rhake^'a' dep'osit to the TeireV%briey 'mdduIe CJ'-5 by- using* - 
25 process Steps 780-792. The To Bank B 47 then posts the accounting transactions '(Step 450; see' '^alsd Fig. 
11. Step2j;J--: ■ ' >■ . . 

' Nbti9S.:'i:i 'afe.ho>rt^='trarisfe the Gbrrespohdent Bank B 2 to th^ Issuiirig iBahW'C i Using Stfeps 

750^770; the ' Issuing Bank: G 1 p'bsts the corresponding vadciiouritihg' trans'a^^^^ see-aiiso- FigV ■ 

11. Step 2). The to-Teller C 34 responds by sending the d^poisit a'ckhbw Step's;^ 
30 2-8. to To Teller application 34 of Teller money module B 5 (Rg. 45A. Step 456). ' 

Here again, tK6 deposit -is checked to see' if it is less thafi thfe amount of electrohie notes 11 that* have 
been removed 'eai-liSrv-and: when it is not. the withdrawar is"-eomjpieted Vvitfr Ihe^ pi^^^^^^ • 
41, to commit Teller rti'dhey module B 5 to Teller mbhey module C 5: : ■ ■ - : : 

A deposit request that is less than the amount of notes 11 that are withdrawn resquires- acbount updating 
35 (Step 460: see also Rg: 11. Step 3). ^nd hew notes 1-1 to replace' the additional hbtes 11 that were taken. 
Accbrdingly. a withdraiwai' request following the prdbess Steps of '920*- 928 fi-b'nri Teller- mdihey mbdule B 5 
to Teller* rridriey iTiOdijle G 5 is made to provide these new eleGtr&hic'not^s 11. 

Teller money module=C 5 must first establish a session 'With the Mbhey Geheriatdi' module 6^. using the 
process Steps 190-258. The new electronic notes 11 are requested by the Teller money mddUle C 5 frbrti- 
40 the Mofiey Generator rhodtile 6 fbllbWmg**'pfocgSg Steps 760">*792, which are theh transferi^ed to the Teller 
money module G 5 usiHg St^ps 750 - 770 to tf ansfei* note's 11- b&tweeih mbriey modules.' ■ 

This-' transfer of electronic notes 11 to 'the Telldr money module G 5 requires that accounting 
transactions be posted by the To Bank application G 47 (Step- 462; Fig, 45B: see also Fig. 11, Step 3). 

Fl'om there, the notes 11 are ti-sthsferfed from the Issuing Bank's -1 Teller mbney module G 5 to the 
45 Gorrespondent Bank's 2 Teller money module B 5 and to the Transaction money module 4 by using Steps ■ 
750 - 770 for tfansferri rig notes 11. Thereafter, each money riiodufe must comhriit td the money' mddUle with 
which it has established a session. Thus, Trarisactibn money module A 4 commits to teller money 'rhodule 
B 5i Teller money module B 5 subsequently commits to Teller money module G 5; which then commits to 
the Money Gehei'al6^ moduli - 6. All three of these commitment trahsactiohS ug'e process Steps? 690 -698 * 
50 above. 

Subscriber To Subscriber Payment 

Figure 36 illustrates the process flow for a- payment transaction from on^ Transaction money module 4 
55 to another. Ih -thi's exampid of a preferred embodiment, Alice (or a' hypothetical payor corporation; is 
denoted "A" in Rgure 36) will agree to pay Bob (or a hypothetical payee corpbration. is denoted "B" in 
Figu're 36) a specific amount of electrbniie money (Step 800)'. Both Alice and Bob sigri on to their respective 
Transactiori money modules 4 usirig the process' Steps* 1 0 42 described above. Through the •= To Sub-- 
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scriber A 33 application, Alice directs her Transaction money nriodule 4 to make a payment (Step 806 & 
810), while Bob operates his Transaction money module 4 such that the To Subscriber B 33 application will 
issue an entitlement to receive payment (Step 808 & 81 2). 

!n Steps 814 & 816 the Session Managers 31 of both Alice's Transaction money module 4. and Bob's 
5 Transaction money module 4 established communications. From there a session is established, as 
described in Steps 190-258 above for transacting between any two money modules. 

With a session established, To Subscriber A 33 prompts the subscriber to enter the amount of payment 
that she desires to transfer (Step 81 8), which is displayed to the subscriber. 

Alice enters the amount that she wishes to transfer to Bob. Pay/Exchange application A 35 receives the 
70 amount entered (Fig. 36, Step 820). The amount entered by type (currency or credit) is now compared by 
Note Directory A 39 to the balance of the value of the electronic money stored in the Transaction money 
module 4, to see if there are sufficient funds available to permit the transaction to proceed (Step 822). 

If there are insufficient funds. To Subscriber A 33 sends the subscriber a notice that there are not 
sufficient funds to cover the transaction desired (Steps 824-826), and prompts the subscriber again for a 
75 new amount of payment (step 827). If the subscriber prefers not to enter a new amount, the abort 
transaction process Steps 500-524 are activated to terminate the communications link between the two 
Transaction money modules 4 On the other hand, a newly entered amount will return the process to Step 
820. to check for sufficient funds again. 

When there are sufficient funds stored in Transaction money module A 4 to process the^-trcinsfer, 
20 Pay/Exchange A 35 sends a message disclosing the amount of the transfer to Bob's Transactioa money 
module 4 (Step 828). using the process^disclosed in Steps 2-8. See Fig. 36A. From there, To Subscriber B 
33 prompts the owner to verify that the amount to be transferred will be accepted by him (Step. .830)v-. Bob 
can then decide whether to accept or reject the amount to be transferred (Step 832). 

If Bob responds in the negative, then Pay/Exchange B 35 will send a message back t0v*^ransactL0n^.. 
25 money module A 4 using Steps 2-8. that the amount to be transferred is incorrect (Step 834); the process 
again returns to Step 826, Fig. 36, to prompt Alice for a new amount to be entered. 

When Bob responds in the affirmative in Step 832. Pay/ Exchange B 35 will send an acknowledgement 
to Transaction money module A 4 using Steps 2-8 (Step 835). Back in Transaction money module A 4. the 
message will be conveyed to Pay/Exchange A 35 to receive the acknowledgment sent by Transaction 
30 money module B 4 (Step 836). 

With this acknowledgement received. Pay/Exchange A 35 will send the amount desired to be , trans- 
ferred to the Honey Holder 38 (Step 838) so that the electronic notes 11 may be transferred using Steps •■' 
750-770. With the transfer completed, the two Transaction money modules 4 must commit to the transfer, 
using Step 690-698 described above. The communication link between the two transaction. ^modules may. 
35 now be terminated. 

Subscriber to Subscriber Foreign Exchange 

Referring to Figure 46. the process flow for an exchange of foreign currencies between two Transaction 
40 • money modules 4 will now be illustrated. In this example Alice (or a hypothetical corporation, denoted "A"- 
in Figures 46-46A) agrees to exchange dollars for pounds with Bob (or a hypothetical corporation, denoted 
"B" in Figures 46-46A). The exchange rate that they have agreed to will be a ratio of dollars to pounds 
(Step 300). 

Alice begins by signing on to her Transaction money module 4 (using Steps 10-42 described above) 
45 while Bob signs on to his Transaction money module 4 (using Steps 10-42). Thereafter, the To Subscriber 
33 applications of both Transaction money modules 4 prompt the respective users to select, a type of 
transaction (Steps 302-303). In this example. Alice and Bob agree to exchange her dollars for his pounds. 

By requesting the foreign exchange transaction. Session Manager A 31 will establish a communications 
link with Session Manager B 31 (Steps 306, 307) so that a session may be established between the two 
50 money modules using Steps 190-258. Alice is then prompted by To Subscriber A 33 for the amount of 
dollars she will sell, and the exchange rate that she will use in the transaction (Step 308). 

Pay/Exchange A 35 receives the input (Step 310) and Note Directory A 39 checks for sufficient funds 
by comparing the amount requested to the amount of value contained in the Transaction money module 4 
(Step 312). An insufficient funds condition will cause the To Subscriber A 33 to send an insufficient funds 
55 message to Alice and prompt the subscriber to select another amount of dollars and exchange rate (Steps 
318-320). When new selections are entered, the process flow returns to Step 312 and continues from 
there. If Alice does not select a new amount, the session is dissolved using abort transaction Steps 500 - 
524. 

35 
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When- the funjj.s. a.r^ :Sufficient to meet the amount requested, the Pay/Exchang6: A 35 sends ttie. amounti 
of the doners and;.the proposed dollar/pound exehange rate (Step 316) to the To Subscriber application' 33: 
of Transaction money module B 4 using the Steps 2 - 8. (See. Figure 46A); At this point, To.Subscrjber B 33 
prompts. Bob with the amount and rate proposed by Alice, to determinB if .the values are what Bob will 

5 agree to exchange (Step 322)/ * . 

The Pay/Exchange B 35 receives the dollar .am.oun.t and the rate-that, is proposed by Alice and if. the 
amount and rate, are not. agreed to by Bob. Pay/Exchange;-. 3-35 will send a mes$age indicating that the 
value or exchange rate is incorrect (Step 326)/ through the Steps of 2.r8 for sending messages. To. 
Subscriber A 33 prompts, Alice for the dollar amount and exchange rate, over again (Step 327), Entry, qf new 

10 values' returns the process to Step 310 for continuation, see Fig. 46, while the lack of new values entered 
catises the.abort transaction process pf Steps 500-524 to be initiated. 

If the amount and rate are agreed, to.by Bob. Pay /Exchange B 35 will calculate the equivalent amour\t in 
pounds, based ^on the rate- provided (opt shown), and. then i.nitiate the step of having Note Directory: B 39 
check to see that Transaction mpney module B 4 contains sufficient funds to fulfill the exchange (Step 

75 323). Wheri the funds, in Transaction money . module B 4 are ^ insuffrcient to meet the exchange. 
Pay/Exchange , B: 3.5 sends a.. message to Alice of insufficient, funds (Step 325) using Steps . 2 tBi; iHi^e.: 
proce.ss ;flow returns to Step 327, ■ ro'; ni.-f . 

Proceeding with the case in which sufficient funds do exist in •. Transaction mortey module :B,t 4^' 
Pay/ExPhange B 35 will send an acknowledgement using Steps 2^8 to Transactipn-imoney mpdurle A; 4a^ 

20 (Step 329); After receiving this acknowledgement; Pay/Exchange A 35 sends the annount . of - dollars: 
requested, to. its Gorresponding, Money Holder 38 application, in Step 330. The dollars are transfei'red frpm- 
Alice.tp Bob via the Steps 750 - 770 d^scribexJ .aboy.e for transferring. notes- 11'. • ^ • -w. . C* 

Pay/Exchange B 35 receives the- notes 11 and then transfers the..amoijnt of ppund.s.;to. its. Mpney .Holder 
38 application (Step 331). From: :t.hgr$), the plectfpnjp ppunds:^re transferred to Aiicpvu.sing -the: transfer notes 

25 process described. in Steps 750- 770. To record this exchange. Transaction money module^ A 4 comrnits- 
with Transaction money module, B;:4 by using process StepS'690 - 698 described .abpye^ VVith: a , satisfa^^^ 
exeh ?ng e r thp- com muni cation siiUnkib etwee n, the two Transaction monpy.mpdules. may. now, be terminated:; 

Foreign Exchange At An Issuing Bank;-. .-. 
30 \r . 

Turningr.attentiQn .now.itp; Figure- 48; if. a. subscriber were to. exchange his/her dollar?; for pounds withvan 

Issuing, Bank 1 instead of withi a. subscriber.. the following process 

Subscriber A sets up the foreign exchange transaction by. signing on to his/her Transaction money, 

module 4.(see Fig. 47Z) using -Steps 10-42 described above. To Subscriber A 33 prompts the subscriber 
35 for the transaction desired (Step 334), and in this example, the subscriber chooses the dollar/pound 

exchange, and the amount of dollars the subscriber will exchange. It is anticipated that the choice of the 

bank to transact with may be an option offered to the subscriber (Step 33.6)- 

The Note Directory A 39 checks for a sufficient balance to complete the request (Step 338). An 

insufficient.:balanGe permits th^ subscriber to again enter the amount he/shp will exchange (Step 34.0^ 
40 342);,'wher.eby Session Manager A 31 will terminate, the transaction (Step. 34,5) if no.new amount is entered. 

Entry of a new am ount. returns the process to. Step/ 338 to check for sufficient fun.ds tp,:.meet the new 

reques.t^;W.hpn the funds are sufficient for th.e^XGh.ange request, a Ne.twprk 25 sign -pn u^ing Steps 50^ 

168 is commenced. 

, ftfter , the ; .Network; 25; sign-on,, th.e;. Nptw.ork ,25 checks, if: a; bank or finan,cj9l; institution hgs been 
45 selected (Stpp, 346); If ,a- bank or financial institution was. not .chosen earlier.- Tp Tpller A 34 must prprDPt the 
Network Server 26, through- Session Manager A .31,;.for a list, of banks or ,fin^nGia.Hinstituti.o.ns:;tha,t wiH.^ 
provide :the exchange . (Steps 348.:; ,350).. The: Network Server;, 26 sends the , list (^long:/vyith rates) to, :the 
subs.cri.be,r thrpug)i the To Tplier A 34: and. To Subscriber A 33 applications (Steps 3j52 - 356).; 

.After: prompting (Step; 357, Fig.; 47A), th^- subscriber chooses a bank Q'r;finanGial institu.tipn.ipr .end^ thP 
50 transgctipn .(Step 359). When a bank oi; financial institution is chosen, a session is established' with . the 
Teller money module 5' chospo'-iusing .Steps; 119.0 - 258 described abqye. After a se.s.sipn. is established, , T,P. 
Teller A 34 . sen.ds ,the amount :oA dollars to be ; exchanged . for pounds (Step 360) using Stpps 2t8 for 
encrypting. and, transmitting :3.:rnpssag.e^ . : .. . .. 

To ensure th^t th§ subscriber, still w^nts to .proceed, with, the exphangPi To Transaction B 4$.' sends the . 
55 current exchange, rate. to the subscriber using .process.. Steps. 2-: 8 (Step -362). At thjs point,- To Subscriber A. 
33 prprnpts the subscriber with the bank's exchange rate and if the subscriber does not wish tp prpceed.^ 
the transaction is. .aborted; by fpl.lpwlng: Steps 500-524 (Steps 364-366), If the transaction is to prpp.eedi 
the dollars are transferred from Transaction money module A 4 to Teller money module B 5 using Steps' 
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750-770 described herein. 

Returning to Figure 48, once the set up of the foreign exchange transaction is accomplished, the proper 

accounting transactions are posted (Step 368; also illustrated in Figure 15. Step 1) to reflect the dollars that 

have just been transferred. A session is established between Teller money module B 5. and a Money 
5 Generator module 6 via Steps 190-258. Teller money module B 5 requests the proper pound notes 11. 

through process Steps 780-792. The notes 11 are returned from the Money Generator module 6 to the 

Teller money module B 5 using Steps 750 - 770. 

This latter transfer of notes 11 requires a corresponding updating of the accounts involved (Step 370; 

see also Fig. 15. Step 2). The notes 11 are transferred to the Transaction money module A 4 through 
70 process Steps 750-770. To complete the exchange. Transaction money module A 4 commits to Teller 

money module B 5 who subsequently commits to the Money Generator module 6 using process Steps 

690-698. 

Foreign Exchange At A Correspondent Bank 

75 ■ . 

The foreign exchange with a Correspondent Bank 2 is described with the aid of Figure 49. Initially, the . 
foreign exchange transaction is set up by repeating process Steps 334-366, (Figs. 47 - 47A) and updating 
the proper accounts (see Rgure 16. Steps 1 -2) to reflect the notes 11 that have just been transferred from 
•^ • the subscriber's money module 4 to Teller money module B 5 (Step 372). Thereafter. Teller money^^^odule 
V ' 20 B 5 will establish a session with Teller money module C 5 at an Issuing Bank 1. by performing process 
Steps 190-258. :.rt.v>.: 

A withdrawal is requested by Teller money module B 5 to Teller money module C 5 using process 
Steps 920-928 described above. To obtain the notes 11 for the request. Teller money module C 5 must, 
get them from a Money Generator module 6. Accordingly, a session is established between thei^twoM^aooey;'.;? 
25 modules via Steps 190-258, and the notes 11 are requested following process Steps 780-792 outlined . 
above. 

The Money Generator module 6 will create the notes 11 requested and transfer them to Tellertnoney 
module C 5 using process Steps 750-770. This is followed by a posting to the proper accounts in the 
(bank's systems (Step 374). see Figure 16, Step 3 for accounting transactions). The notes 11 are now 

30 transferred from Teller money module C to Transaction money module A 4 via Teller money module B 6 
• using for each transfer the process Steps 750 - 770. Finally, all the sessions must be committed, and 
Transaction money module A 4 commits to Teller money module B 5 who in turn commits to Te!ler^money 
module C 5 using Steps 690-698. Teller money module C 5 commits to the Honey Generator module. 6 to 
. complete the exchange of dollars for pounds. 

35 ■■■ 
Updating Notes. Certificate - u:.:-- 

/ V As mentioned above, it is anticipated that the date of expiration of a note, used as a security measure, 

' may expire while it is stored in a Transaction money module 4, If this occurs, the holder of expired notes 11 

40 will not be able to transfer them to another Transaction money module 4, but the holder may deposit them 
or exchange them for new notes 11 by transacting with a participating bank or financial institution. 

Additionally, if the certificate associated with a particular Transaction money module 4 expires, the 
subscriber must sign on the Network 25 to update the certificate in order to transact with another 
Transaction money module 4. The following is a description of the process flow for updating an expired 
45 certificate or expired notes 11. 

Beginning at the top of Figure 50. a subscriber signs on to the Transaction money module 4 using the 
Steps 10-42 described above, and is prompted by To Subscriber A 33 to select a transaction (Step 570). 
After selecting the transaction for "updating" (Step 572), a sign -on to the Network 25 is performed using 
Steps 50-168. The sign -on to the Network 25 will perform the updating of the certificate, as described 
50 above with reference to Figure 33-33A. 

For updating the notes 11, the Session Manager A 31 sends the update notes request to the Network 
25 (Step 574); the Network Server 26 responds by sending the selected bank identifier back to the 
Transaction money module 4 (Step 576). Now. a session may be established between the Transaction 
money module A 4 and the Teller money module B 5 of the bank selected, using Steps 190-258. 
55 Once the session is established. To Teller A 34 sends the request to update notes 11 (Step 578) using 
the message sending routine in Steps 2-8. To Transactor B 32 responds. Fig. 50A, with an acknowledge- 
ment (Step 580) sent using Steps 2-8. Transaction money module A 4 can now transfer the expired notes 
11 to Teller money module B 5 using Steps 750-770. Thereafter, the corresponding accounting (see 
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Figure 24. Step 1) is performed in the bank's records (Step 582), and a session is established- betw6dh 
Teller rifiohey inodule B 5 and the Mor^ey Generator module 6 through Steps 190^258: 

the request notes routine df Steps 780-792 is theri perfoVm^d. The Mdhey Generator module 6 sends 
the requested notes 11 vi^ Steps 750-770. and updates the accounts at ih& bank (Step 584; s6e alsd Fig-' 
5 24; Step 2).- Teller mon^y m6dule> B 5 tak^S the updated hbtes' ii ahd passes' th'eirn to frans'aetibn mbn6V 
mbdule A 4 using the same Steps 750 ^ 770- ' < 

Now that the notes 11 have been updated in the Trarisactidh nibhey rnbdUle 4. the sessibiis a^'e 
completed by having Transaction money rnodule A 4 cbmm'it to Telley money module B 5, and having 
Teller rribney module B 5 thfeh cdrrimit the transaction with' th§ Hbhey Gfeherator module 6. Finally, both 
JO coiinnriitting routines are perfoi'hried using Ste^^ : ' ' 

The above described prdeess fibws illustrate the capability of the invention to' provide ah improved 
system for exchanging electronic representations of economic value, while avoiding the inherent lirriitations 
of paper based monetary systems. 

Operation of the invention has been described primarily with currency ndtes and credit ridt§s that can 
75 be used by subscribers in the same processes. It will be understood that the described system can also be 
adapted' to bther^ monetarii^ instruriiehts:- For example', persdrial and corporate cheeksrand bank vd rafts 'e'bu Id 
be p'^ovided by iehhanctng is'e'versfl -of -thb Transatitbr applicatibhs. More Gbmplieated multipatrty payrfleht 
processes' such as lettehs: of -Gredlif anei banker's' acceptances could also be pfovrded with appmpriate' 
changes to the Systeni. It rhay also be possible' to adapt the systerti of the- invention to providei cbrpbrate 
20 financial obligations Such as cbnhnierd^ 

Moreover, although the. invention has been described in detail with particular reference to a preferred - 
embodiment thereof, it should be uhderstobd fhSt^the' ihvehtidri'is-capable of dthei- and different em bWi - 
ments. and its details are capable of nhodificatidhs- rn various obvious respeets; * As is reaidily abparent- to 
those skilled ih the art. variatibn& ahd mddificatitfns/Gah^ be affected' while^ y^emalliihg. witFiihqh'&^ 
25 scope of the' invention. Accordingly,, the foregoing disclosure; descriptidn. and figures ^ are foi' illustrative 
purposes only, and do not in any way limit the invention, which is defined only by the claims. 

Claims • ■ - ■ ; . ^ 

30 1. An ^Itorbnic monefary^systehi''fop:providin'g transactions utilizing eli^ctronic r^preisentatloriS of bur^reridy = 
backed by demand deposits ih' a bank comprising: - - 

■ medns for genei-ating said electronic re'p^^ . i- A ■ ■: ■:\r^^r^ . i , . 

< • teller me^ns for issuing and distributing' said electronic represbntatiohs' of eurrericy ; . " ' 
transacting means for storing, and for transferring said elfectrdriic ' repre'Sentatidns' of c 
35 between other transacting means and between said transacting means and said teller means. 

2. An electronic monetary system for providing transactions utilizing electronic representations of credit 
authorizations comprising: . ^ 

meians for generating said electronib representations of credit; 
40 • • teller means for issuing and distributing said electronic re'presen'tatidns of credit; 

transaction means for storing, and for transferring said^le'ctrdnic representations of credit between 
'Other transacting means and between said transacting means and said teller- means. 

3. An electronic monetary system accoi-ding to: claim i claim 2 further comprising a- meariS for 
45 maintaining the security and integrity of said electronic monetary system, i ■ ' 

4. Ah electronic monetary systern ^according' to eiaim-.M or clairn 2 further COmpnsrng a' means for ' 
providing a communication network' between said generating means, said teller means, said transacting 
means, and said security means': t-: ' .. . . w : . 

so :: ,■ 

5. An electronic monetary system according to-'claim. ;1. or- clairti 2 further^ CQmprtsing; la'-means* for 
maintaining and processing account datavfiles::for storing records of said eleetrdnic refjresehfatidriS of 
currency^ or iiredit issued by said generating means' and-record^ of said electronic representatibns of : 
currency of credit transferred by said transacting' ;rneans to said teller m^^^ A ' r- . 

55 ^ • ■ . * ■ • . ■•,() 

6. An electronic monetary systerh. ^ceording'.;t6 claim" 3' 'Wh6 rein said security means further com prises' a ' 
time limit on the transfbrability of- said electronic -repres'entatioris of credit and said eledtrbriiCj Fepre-^- < 
sentatibns of currency among said transacting niieans.' 
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7. An electronic monetary system according to claim 3 wherein said generating means, said teller means 
and said transacting means each comprise an individual identifier, and said means for maintaining the 
security of said electronic monetary system further comprises a certification means for providing a 
unique certificate of said identifier of each of said generating means, said teller means and said 

5 transacting means. 

8. An electronic monetary system according to claim 7 wherein said certificate further comprises a time 
limit on its acceptability by said generating means, said teller means or other of said transacting 
means. 

10 

9. An electronic monetary system according to claim 1 or claim 2 wherein said generating means further 
comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

75 10. An electronic monetary system according to claim 1 or claim 2 wherein said teller means further 
comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

11. An electronic monetary system according to claim 1 or claim 2 wherein said transacting meana^Mrther 
comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. . 

12. An electronic monetary system according to claim 1 or claim 2 wherein said electronic represeritations^ 
of currency or said electronic representations of credit are undeniably acceptable as econornie^va^uei:.- , .,. 

25 

13. An electronic monetary system according to claim 1 or claim 2 wherein said electronic represer^tations , 
of currency or said electronic representations of credit are commutable and transferrable in values less 
than or equal to their original economic value when generated. 

30 14. An electronic monetary system according to claim 13 wherein said electronic representation of qredit is 
transferable only one time by said transacting means. -rr 

15. An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit further comprise indicia of • ^ 

(1) whether said representation is a currency or a credit representation. .■ . 

(2) its said time limit of transferability, and 

(3) its economic value. , . 

An electronic monetary system according to claim 15 wherein said indicia further comprise indicia of 

(1) said certificates of said other transacting means, 

(2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

An electronic monetary system according to claim 16 wherein said indicia further comprise indicia of 

(1) a digital signature of said generating means, 

(2) a digital signature of said teller means, and 

(3) a digital signatures of said other transacting means. 

An electronic monetary system according to claim 1 or claim 2 wherein said generating means, said 
teller means, and said transacting means are each comprised of a programmable processing device 
contained in a tamper - proof housing. 



16. 

40 



17. 

45 



18. 



19. An electronic monetary system according to claim 18 wherein said generating means, said teller 
means, and said transacting means are configured to perform as a modular co - processor of a general 

55 purpose computer. 

20. An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending programmable processing devices. 
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21. An electronic monetary system' aecdrdihg to claini' 1 or claim 2 further comprising a means for clearing 
said electrortic representations of credit and cufrehey issued by rtibre than one bank. 

22. An electronic monetary system aecdrdihg to claim 1 or claim 2 whierein said financial f acuities' fuiiher 
5 comprise an accounting structure to monitor the distribution of said electronic representation^ of 

currency or said electronic representations of credit and each financial facility's obligation after any 
fihahciai ti'ahSactibri. ■ - . . ' - 

23. An electronic monetary system according to claim 18 wherein said programmable processing device in 
70 said transacting means further comprises separate lists for accounts associated with the owner of said 

transacting means that are held at e^ch of said different financial facilities. "■ 

24. An electronic monetary system according to 'Claim 23- wherein each of satid lilst of aec6urits further 
comprises a digital signature of the financial facility maintaining said accounts, to provide security from 

75 unauthorized access of said acedurils-: 

25. An electronic monetary system ''keiebryihg to claiiti 1 or claim 2 whei-eih said generating meah's- is 
configured to generate said electronic representations of currency or said electronic representations of 
credit for a plurality of fhon'etary unit's. ' ■ " ' 

20 y,- , ■ . ■ - 

26. An electronic monetary system according to claims 18 wherein each of said ^rbgirammablei 'processing 
devices can be personally coded to prohibit use by unauthorized persons, such coding being 
performed by an individual- that does not have any relationship with any of said financial faeilitie's. and 
whose identity remains Anonymous.' ■ ' • 

25 

27. A monetary ' system - using -ele^^^^ repriBsentatioris of m'oh'ey and ihdudirig at least' 6h^ fihahciaF - ' 
•facility^an'd subscribers served by said facility, said system comprisihg: 

a plurality of subscriber processors, each adapted fo ddntairt said eletfrdriic representations in- the 
form of machine readable digital objects containing data indicative of the monetary value represented 
30 and the^curr^rit- validity' bf said represfentatidrt 

processing means operated by said financial' facility 'and- capaible- of c^^^^ 
subscriber processors for the deposit in said facility of representations stored in said subscriber 
processors, or the withdrawal or representations frbrh said facility to said subscriber prbteSsors; 

said subscriber prbceissors ailsb indubtrtg cbrinriluni&atioh and processing fuhGtioh^ enabling 
35 exchange of said representations between subscriber processors, " ) 

28. A system according to claim 27 in which said money representations are configured to be functionally 
equivalent to bank notes. 

40 29, A system according to claim 27 including a certification isburce ^nablirig* the ptocessiri'g- bf said 
representations to indicate their validity. * . 

30- A system according to claim 27 in which there are a plurality of said financial facilities and a clearing 
facility for clearing transaictibns among said 'financial facilitieis and said subscriber processors'.' ■ " ' 

45 ' . >=^^^ i:v 

31. A system according to claim 27 in which said data stored in said Sub^cribbr prdcessbrs includes data 
representations for ascertaining the status of said representatiohs. 

32. " A systern* according to claim 27 in which said electronic repfesentatibrts of nridriey stored "in 'said • 
50 subscriber processors are replaced with updated representations during transactions with said finaricial 

facility. - 

33. A monetary system using electronic media to Securely arid reliably exchange economic value, said 
monetary system comprising: 

55 electronic representations of credit authorizations and electronic representations of currency 

backed by demand deposits in a bank; 

means for generating said electronic representations of credit and said electrdnie representations of^^ 
currency; • . ■ . . 
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teller means coupled to said generating means for Issuing, distributing, and accepting said 
electronic, representations of credit and currency; and 

transacting, means for storing, and for transferring said electronic representations of credit and 
currency with other transacting means and between said transacting means and said teller means. 

A monetary system according to claim 33 further comprising a means for transmitting said electronic 
representations in a secure manner between said generating means, said teller means and said 
transmitting means to maintain the security and integrity of said monetary system. 

A monetary system according to claim 34 wherein said security means further comprises a time limit 
on the transferability of said electronic representations of credit and cun-ency among said transacting 
means. 

A monetary system according to claim 34 wherein said generating means, said teller means and said 
transacting means each comprise an individual identifier, and said means for maintaining the security of 
said monetary system further comprises a certification means for providing a unique certificate of said 
identifier of each of said generating means, said teller means and said transacting means. 




37. A monetary system according to claim 36 wherein said certificate further comprises a time limit on its 
20 acceptability by said generating means, said teller means or other of said transacting means. 



38. A monetary system according to claim 34 further comprising a networking means for"'pr^vidi'hg/a 
communication link between said generating means, said teller means, said transacting means, and 
said security means. 

25 

39. A monetary system according to claim 33 wherein said generating means is configured for generating 
said electronic representations of credit and currency for a plurality of monetary units. . 

40. A monetary system according to claim 33 wherein said electronic representations of credit and 
30 currency are undeniably acceptable as economic value, and are commutable and transferrable in 

values less than or equal to their original economic value. 

41. A monetary system according to claim 40 wherein said electronic representation of credit. is. transfer- 
able only one time by said transacting means. . .. . .. 

35- 

42. A monetary system according to claim 33 wherein said generating, means further comprises a public 
key digital forming means for forming a digital signature on said electronic representations of credit and. 
currency. 

40 43. A monetary system according to claim 33 wherein said teller means further comprises a public key 
digital forming means for forming a digital signature on said electronic representations of credit and 
currency. 

44. A monetary system according to claim 33 wherein said transacting means further comprises a public 
45 key digital forming means for forming a digital signature on said electronic representations of credit and 

currency. 

45. A monetary system according to claim 41 wherein said electronic representations of credit and 
currency comprise indicia of 

50 (1) whether said representation is a currency or a credit representation. 

(2) its said time limit of transferability, 

(3) its economic value. 

(4) said digital signature of said generating means, 

(5) said digital signatures of said teller means. 

55 (6) said digital signatures of other transacting means, 

(7) said certificates of other transacting means, 

(8) said certificates of said teller means, 

(9) said certificate of said generating means, and 

41 
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(10) an identifier of said electronic representation* of ^currency or credit 

46, A monetary system according to claim 33 wherein said generating means, said teller means, -and said 
transacting means are each comprised of a programmable processing, device co'ntaihed in a tamper - 

5 proof housing. 

47. A monetary system according to claim '46 wherein said generating means, said teller means;, and said 
transacting means are configured to perforrh as a modular ed - processor of a conhputer, 

10 48. A monetary system according to claim 33 further cortipi-ising a means for clearing said electronic: 
representations, of credit and currency issued' by more than one bank. 

49. A method of using electronic representations of cun-ency or electronic representations of credit 
provided by at least one financial facility having a means foV generating said electronic, representations, 

75 and a teller means for issuing and ^ceptlng said elecfronic representations arid serving subscribers of 
. said facility; comprising the steps Qf: - 

(1) generating said eflectronic representations of currency backed by demand .depo'sits or generating 
said electronic representations of credit authorizations; 

(2) issuing to said subscribers and accepting from said subscribers electronic representations* of . 
20 currency or credit, wherein the issuance and acceptance is performed- by: said teller means at said 

financial facility; and 

(3) providing said subscribers- with ■ a transacting nrieans for . accepting said issued electronic 
representations of Currency or credit,, and .for. transferring said electronic representations of currency 
or credit to both other subscribers having said transacting means, and to said teller means. . ! 

25 

50. The . method bf clainn 49 further comprising the: step. ot digitally signing, said, electronic representatldns^'> 
of currency or creditao:pr'ovide3 authenticity and. security: from: duplication or modification. 

51. Thei method of claim. 50 . .further comprising the= step of limiting ther time period that said electronic' ■ 
30 representations of currency or credit may be transferred among said/transacting .me&ns. . 

52. The method of claim 51 further comprising the step of removing all of said electronic representations of 
currency stored In said transacting means whenever^ , sgifei trahsacting means transacts with said* . 
financial facility, the step of generating new electronic representations of -Gurrenty having a renewed 

35 time limit on transferability, and the step of replacing said original electronic representations of currency 
. In said transacting meanis with said. new::electronic representations? of cgrreinc , . • : 

53. The method of claim 51 further comprising the step of removing all non - transferred electronic 
representations of credit authorizations stored in said transacting means only whenever said transacting 

40 nrieahs transacts with the financial facility issuing ^said electronic; representations of credit, the step' of / 
generating new electronic representations :0f credit, having a renevyed, time lirnit on transferability, and 
the step of replacing said original electronic representations of credit in said transacting means with 
said new electronic representations of credit. 

45 54; The method of claim 49- further comprising the steps pf clearing, ; and. maintaining records of, said 
electronic representations of currency or credit issued by said financial facilities. 

55. The method of claim 49 further comprising the step of providing an identifier unique to- each of said = 
generating means, said teller means and said transacting means. 

50 , 

56. The method of claim 55 further comprising the step of certifying, for a limited period oftim^ the validity 
of said identifier of each of said generating means, said teller means and said transacting means. 

57. The method of claim 56 further comprising the step of providing a list of any offending : teller ^means, 
55 generating means, or transacting means to each of said generating means, said teller, means and said 

transacting means. 
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58. The method of claim 49 further comprising the step of generating said electronic representations of 
credit and currency for a plurality of different monetary units. 

59. The method of claim 49 further comprising the step of providing an accounting structure at said 
5 financial facilities to monitor the distribution of said electronic representations of currency or credit, and 

each financial facility's obligation after any financial transaction. 

50. The method of claim 59 further comprising the step of storing in said transacting means separate lists 
for accounts associated with said subscriber at each of said financial facilities. 

70 

61. The method of claim 60 further comprising the step of digitally signing each of said list of bank 
accounts with the digital signature of the corresponding financial facility, to provide security from 
unauthorized access of said accounts. 

?5 62. The method of claim 55 further comprising the step of maintaining records of transactions undertaken 
by said generating means, said teller means and said transacting means and storing said records within 
each of said respective generating means, said teller means and said transacting means, wherein said 
transaction record includes indicia of the date of transfer, the amount of transfer, an identifier of the 

/ financial facility issuing said electronic representations of currency or credit, and an identifiat^vPl .the. 

V 20 electronic representation of currency or credit transferred. ..r. .v,; 

63. The method of claim 62 further comprising the step of maintaining copies of said electronia.<eprey- 
sentations of currency and credit issued at said financial facilities, and the step of updating said copies, 
upon transacting with any of said transacting means. ^r.- ^ 'K^ : 

25 

64. The method of claim 63 further comprising the step of reconciling said copies of electronic repre- 
sentations of currency and credit with electronic representations of currency and credit that hav& been 
cleared in said financial facilities. 

65. The method of claim 64 further comprising the steps of: 

(1) storing records of individual transactions that have occurred among said transacting means to a 
separate storage means, 

(2) submitting said records of individual transactions stored in said storage means.to, said financial 
facilities when said electronic representations of currency or credit are stored in a transacting means 
that becomes lost or stolen, and 

(3) comparing said records of individual transactions among said transacting means with records 
produced by said reconciliation of said electronic representations of currency and credit to deter- 
mine the true value of said electronic representations of currency and credit stored in said 
transacting means that may be lost or stolen, for accurate replacement of said value lost.. 

66. The method of claim 49 further comprising the step of providing a communication, network, linking 
together said financial facilities and said transacting means. 
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FIG. 6 
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